Relying party specific Credential and Metadata

[Nate Klingenstein]

Sean,

> I've obtained said cert, placed it and the private key in /credentials

You can store the certificate and key wherever you want.  Just make sure you have appropriate file permissions to protect them.

> and modified the relying-party.xml configuration to utilize this cert for both signing and encryption
> with the relying party.  
> 
> So, my questions:
> 
> - Do I also need to create a jks keystore as well?  Where is this referenced in the config?

Shibboleth itself doesn't need a keystore in addition to the flat file certificate/key.  Your web interface, if you're using any features that require back-channel queries(e.g. typically 8443), will need the same credentials and its own port and may prefer to use a keystore.

The IdP installation script generates a .jks file as a convenience to deployers because everyone loves keytool.

> - When giving my IdP metadata to the new relying party, I assume that, considering all other aspects of my IdP are the same as for my other relying-parties, I can simply replace the inline x509 base64 text in my usual metadata info and give that to the relying-party

Yes, with the exception of back-channel query endpoints, if you use them with both this SP and any other SP.

Hope this helps,
Nate.