Back-Channel Attribute Authority

[Joshua Riffle]

I see what you mean. Is it assumed that the self-signed certificate on the
attribute authority endpoints matches the one in the IDP's metadata? Or
likewise should they be different for security reasons?


Joshua Riffle
Software Engineer
*Azusa Pacific University*


On Fri, Jul 12, 2013 at 7:50 AM, Cantor, Scott <cantor.2 at osu.edu> wrote:

> > I see this does seem to be a trend with other Identity Providers in
> InCommon
> > federation metadata but I haven't seen a documented technical reason why
> > you shouldn't just use the same port and certificate for all of your
> endpoints?
> > So my questions is simply -- why? I'd like to understand this better.
>
> Two primary ones:
>
> - The choice to stick with mutual TLS from the earliest days to
> authenticate the client. There are a variety of problems trying to do
> client TLS on a subset of a vhost.
>
> - Using non-self-signed certs for SAML exchanges creates a requirement for
> constant cert rollover  or for the use of PKIX at runtime, which we
> abandoned many years ago in probably the single smartest decision I've ever
> made (after trying to support it, which was the dumbest).
>
> -- Scott
>
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130712/db5af725/attachment.html