Back-Channel Attribute Authority

[Tom Scavo]

On Fri, Jul 12, 2013 at 10:55 AM, Joshua Riffle <jriffle at apu.edu> wrote:
> Is it assumed that the self-signed certificate on the
> attribute authority endpoints matches the one in the IDP's metadata?

Yes. A KeyDescriptor with XML attribute use="signing" is also used for
SSL/TLS on a back channel (port 844).

https://spaces.internet2.edu/x/_YuKAQ

> Or
> likewise should they be different for security reasons?

Different than what?

Tom

> On Fri, Jul 12, 2013 at 7:50 AM, Cantor, Scott <cantor.2 at osu.edu> wrote:
>>
>> > I see this does seem to be a trend with other Identity Providers in
>> > InCommon
>> > federation metadata but I haven't seen a documented technical reason why
>> > you shouldn't just use the same port and certificate for all of your
>> > endpoints?
>> > So my questions is simply -- why? I'd like to understand this better.
>>
>> Two primary ones:
>>
>> - The choice to stick with mutual TLS from the earliest days to
>> authenticate the client. There are a variety of problems trying to do client
>> TLS on a subset of a vhost.
>>
>> - Using non-self-signed certs for SAML exchanges creates a requirement for
>> constant cert rollover  or for the use of PKIX at runtime, which we
>> abandoned many years ago in probably the single smartest decision I've ever
>> made (after trying to support it, which was the dumbest).
>>
>> -- Scott
>>
>>
>> --
>> To unsubscribe from this list send an email to
>> users-unsubscribe at shibboleth.net
>
>
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net