Including keyName in keyInfo

[Matheesha Weerasinghe]

Hi Brent

My interest here is to test some interoperability stuff with AD FS 2.0. Its
for use in a lab environment.

So if you could give some instructions, I have a java developer who I can
get the help of to follow your instructions and try implement it here.

Thanks

M




On 18 April 2013 02:15, Brent Putman <putmanb at georgetown.edu> wrote:

>
> On 4/17/13 10:13 AM, Cantor, Scott wrote:
> >
> > The schema for the Credential element in the relying-party config appears
> > to support a KeyName element. My speculation would be that might cause it
> > to be inserted.
>
> No, that alone won't do it unfortunately.  That just lets you attach a key
> name to the Credential.
> The contents of a signature's KeyInfo is based on the config of the
> KeyInfoGenerator that gets
> called to generate a KeyInfo from the Credential.  On the default
> KeyInfoGenerator used throughout
> the IdP, the flag to emit the Credential key names is false.  So the mere
> presence of the name on
> the Credential won't do it.
>
> We don't currently expose any way to configure that in the IdP.   It can
> be done with a pretty
> simple bean (probably half a dozen lines of Java code) that you'd wire in
> internal.xml.  If the OP's
> need is great, I can supply some guidance and/or code.  It would also be a
> global change, there's
> currently no framework for per-relying-party config, etc.
>
> Hopefully this will be more exposed for configuration in v3.
>
>
> >
> > I actually thought we did include key names generated from a certificate
> > already.
> >
>
>
> No, not by default.  The X509KeyInfoGenerator *can* generate key names
> from the whole subject DN,
> the CN of the subject and/or alt names, as well as the key names and
> entityID set directly on the
> Credential (the latter 2 for any basic Credential type).  But those
> options all default to off in
> the IdP.
>
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130419/f04c8a1f/attachment.html