Configuring Salesforce for Shibboleth IdP (newbie)

[Tom Scavo]

On Mon, Oct 14, 2013 at 4:39 AM, David Perry <DPerry at hull-college.ac.uk> wrote:
>
> Our IdP has two certificates - one is the behind the scenes one it creates
> itself, when you install it (and I think lasts for 20 years).

A self-signed certificate used for XML Signature and XML Encryption
lasts indefinitely (or until it's compromised in some way). The
expiration date on the certificate is irrelevant. Indeed, the
certificate itself is irrelevant. If there were a nice, easy way to
handle bare keys in metadata, we would gladly dispense with those
nasty certificate wrappers since they bloat the metadata and only lead
to confusion.

> There is, however, also one that Apache uses purely for the https:// website
> - we get those via IT from their provider and just update the file in the
> apache config. I have heard of places that use this 'public' certificate for
> the behind the scenes (Idp-SP) channel as well.

That is definitely not recommended since the deployer is then forced
to migrate certificates in and out of metadata unnecessarily. Although
certificate migration *can* be done without affecting
interoperability, in practice it causes breakage all too often. Just
last week we had a vendor who started a certification migration
incorrectly, which caused a 24-hour outage of their service.

> Having recently deployed an SP, I'm guessing Salesforce requires your IdP's
> 'metadata'/signature - the installer generates it automatically (on our IdP,
> it's in /opt/shibboleth-idp/metadata/idp-metadata.xml). This is based on the
> behind the scenes certificate I mentioned above.

Yes, and instead of using metadata, Salesforce requires you to
copy-and-paste your certificate into their web interface, which almost
guarantees you're going to have issues when time comes to migrate to a
new certificate. With one voice, we need to push back on this archaic
approach to bilateral federation and require vendors to support
multilateral federation using metadata.

Tom