SP metadata: certificate for signing and encryption

[Alexey]

Thank you very much, you very well and clearly explained all.

However, I do not need the default settings, because the vendor of IdP
provided the so-called "metadata template" where indicated what and where
should be spelled out.

Here is relevant part (verbatim):


> ...
> <md:KeyDescriptor use="signing">
>  
>    
> <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
>  
>       
> <ds:X509Data>
>  
>          
> <ds:X509Certificate>
>              
> 		 It is necessary to insert here the certificate of the signature 
> 		 key of the service provider in X509 DER format and Base64 encoded	     
>           
> </ds:X509Certificate>
>  
>       
> </ds:X509Data>
>  
>    
> </ds:KeyInfo>
>  
> </md:KeyDescriptor>
>  
> <md:KeyDescriptor use="encryption">
>  
>    
> <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
>  
>       
> <ds:X509Data>
>  
>          
> <ds:X509Certificate>
>  
> 		 It is necessary to insert here the certificate of the signature 
> 		 key of the service provider in X509 DER format and Base64 encoded
>          
> </ds:X509Certificate>
>  
>       
> </ds:X509Data>
>  
>    
> </ds:KeyInfo>
>  
> </md:KeyDescriptor>
>  
> ...

I do so:


> ...   
> <md:KeyDescriptor use="signing">
>     
> <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
>         
> <ds:X509Data>
>             
> <ds:X509Certificate>
>                 MIID...ZiQ==
>             
> </ds:X509Certificate>
>         
> </ds:X509Data>
>     
> </ds:KeyInfo>
> </md:KeyDescriptor>
> <md:KeyDescriptor use="encryption">
>     
> <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
>         
> <ds:X509Data>
>             
> <ds:X509Certificate>
>                 MIID...ZiQ==
>             
> </ds:X509Certificate>
>         
> </ds:X509Data>
>     
> </ds:KeyInfo>
> </md:KeyDescriptor>
> ...

It does not work.

So, AFAIK for signing I should use the certificate of my private key, and
for encryption I should use the certificate of the open key of IdP.

IMHO should be so:


> ...
> <md:KeyDescriptor use="signing">
>     
> <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
>         
> <ds:X509Data>
>             
> <ds:X509Certificate>
>                certificate of my private key here
>             
> </ds:X509Certificate>
>         
> </ds:X509Data>
>     
> </ds:KeyInfo>
> </md:KeyDescriptor>
> <md:KeyDescriptor use="encryption">
>     
> <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
>         
> <ds:X509Data>
>             
> <ds:X509Certificate>
>                 certificate of the open key of IdP here
>             
> </ds:X509Certificate>
>         
> </ds:X509Data>
>     
> </ds:KeyInfo>
> </md:KeyDescriptor>
> ...

Am I right? I would be very grateful for the information.




-----
Kind regards, Alexey
--
View this message in context: http://shibboleth.1660669.n2.nabble.com/SP-metadata-certificate-for-signing-and-encryption-tp7603709p7603737.html
Sent from the Shibboleth - Users mailing list archive at Nabble.com.