Including keyName in keyInfo

[Matheesha Weerasinghe]

AD FS doesn't need keyname. But if it receives keyname it must match cert
Subject. I am trying to see what AD FS accepts/rejects by playing around
with various formats of element values in the signature.

I'll give this a shot and see how it goes.

Thanks

Mat


On 19 April 2013 21:00, Brent Putman <putmanb at georgetown.edu> wrote:

>
> On 4/19/13 2:21 PM, Matheesha Weerasinghe wrote
>
> >
> > My interest here is to test some interoperability stuff with AD FS 2.0.
> Its for use in a lab
> > environment.
>
> Does ADFS really require a key name like that?  I think other people have
> interoped with ADFS and
> didn't have that requirement.
>
>
>
> >
> > So if you could give some instructions, I have a java developer who I
> can get the help of to
> > follow your instructions and try implement it here.
>
>
> I forgot that I already had a little project that illustrates close to the
> same thing for
> customizing some XML Encryption behavior, so I just added this to it and
> threw it in Subversion. You
> can checkout from the Subversion URL below [1].  Basically check out and
> do an 'mvn package'.  The
> install docs are in doc/INSTALL.txt.
>
> The extension is just hardcoded to enable the emitKeyNames flag on the
> KeyInfoGenerators.  As Scott
> mentioned, you'd need to then populate the KeyName element on the
> Credential config in the IdP.
> This extension should then let those get expressed if they are present.
>
> You could also easily add some code in the config bean to play around with
> some of the other
> properties on the generators to emit KeyNames from the DN, CN and subject
> alt name cert info, as
> well as any of the other generator properties.  See the OpenSAML Javadocs
> for details on all of
> those options.
>
> If there were enough interest to justify, the extension's config bean
> could be expanded to its
> logical conclusion and expose property setters which would allow
> declarative config of most of the
> OpenSAML global security configuration right in the internal.xml.
>
> --Brent
>
>
> [1]
>
> https://svn.middleware.georgetown.edu/putmanb/shibboleth-idp-ext-opensaml-custom-security-config/trunk/
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130421/34e7900f/attachment.html