using a cert bundle in a TrustEngine

[Cantor, Scott]

On 1/31/14, 10:45 AM, "Liam Hoekenga" <liamr at umich.edu> wrote:
>
>I /thought/ that I needed to define a TrustEngine if the SP was going to
>send signed and / or encrypted assertions to our IdP.

An SP doesn't send any of that to an IdP. Assertions are issued by IdPs,
not SPs.

It may sign requests, in which case you need metadata containing its
signing key. And you need its encryption key to encrypt data to it. If you
already have the metadata, and are doing nothing to verify it because you
manually added it to a file, then there is nothing else to do other than
deal with the fact that any time the keys change, things will break.

If you're trying to verify a remote source of metadata, then you still
don't need a cert chain, you need the key used to sign the metadata, same
as with InCommon. If you really want to indirectly verify that, you can, I
suppose.

-- Scott