Metadata, examples, best practices?

[Cantor, Scott]

On 11/27/13, 3:07 PM, "Jason Gauthier" <jgauthier at lastar.com> wrote:

>I have 3 services on one Apache host. To save certificates/pricing, I
>used a "wildcard" cert.  (I think it just has multiple subjects, but the
>idea is the same)

I'm not in any way talking about what you do for TLS. The point is, that
has nothing to do with SAML. Do what you want, just don't connect that
certificate (or generally the key) to your SAML usage.

>Are you saying that I should not use the public cert on the relying
>party, but actually use a self signed? (this is how I am interpreting
>commercial TLS)

Yes, and it should be long lived out to 2037 or so, avoiding the 2038 bug
but otherwise avoiding hassles with renewal.

If you want ADFS to update metadata remotely, it forces you to use a
"trusted" certificate. That's insecure in its own right (commercial TLS is
a joke), but if it also crosses the line into ADFS associating that
keypair with the RP trust, now you have a major upgrade headache annually
or biannually.

But to be fair I didn't think ADFS actually did that though. It allows you
to supply metadata to provision the trust, but I don't think it cares
whether the TLS certificate at the endpoint is related to the key in the
metadata. I think it just wants it to be a trusted cert from a typical
browser connecting to https perspective.

My comment is really more directed at what's in the metadata, and in that
scenario I know that ADFS will not allow you do include the same key in
more than one RP's metadata.

-- Scott