shibboleth2.4 configuration error

[Cantor, Scott]

On 11/22/13, 3:52 PM, "jfu" <jfu_gengyue at hotmail.com> wrote:
>
>saml.crt and saml.pem are given by our Service Provider.

Then they are in trouble because they just handed you their private key.
Now they have to rekey and make sure they have no other customers using it.

It doesn't sound like either party here has a grasp of the model. That's
not going to produce a positive outcome.

>So I change trustEngine configuration to this
>urity:TrustEngine id="shibboleth.SPMetadataTrustEngine"
>xsi:type="security:StaticExplicitKeySignature">
>     <security:Credential id="SPCredentials"
>xsi:type="security:X509Filesystem">
>            
><security:PrivateKey>/opt/shibboleth-idp/credentials/saml.pem</security:Pr
>ivateKey>
>          

You don't specify a private key when you're verifying metadata.

> 
>I download metadata from the URL and open it. the encrypted code
>between<ds:X509Certificate></ds:X509Certificate>is different from
>saml.crt.
>I am not sure if they need to be the same.

The key in somebody's metadata does not have to be the same as the key
used to sign it.

-- Scott