SP metadata: certificate for signing and encryption

[Peter Schober]

* Alexey <strolling.code at gmail.com> [2014-07-15 10:31]:
> However, I do not need the default settings, because the vendor of IdP
> provided the so-called "metadata template" where indicated what and where
> should be spelled out.

That just re-states the defaults, so you can ignore it, undo any
changes you made, and just use the software defaults. It should Just
Work.

> Here is relevant part (verbatim):
[...]
> > <md:KeyDescriptor use="encryption">
> > <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
> > <ds:X509Data>
> > <ds:X509Certificate>
> > 		 It is necessary to insert here the certificate of the signature 
> > 		 key of the service provider in X509 DER format and Base64 encoded
> > </ds:X509Certificate>

Seems they even managed to confuse themselfs here (copy&paste error?)
by stating that the public key from your encryption key pair should be
the public key from your signature key pair, but for you that's
irrelevant.
You will only have one key pair (used for both, encryption to your SP
and verification of signatures from your SP) by default.

> It does not work.

Sorry, that's not a technical error description. What's the error?
That the IDP, which you gave the new SAML metadata to, used the new
key and encrypted SAML protocol messages to your SP, but your SP could
not decrypt it?

> So, AFAIK for signing I should use the certificate of my private
> key, and for encryption I should use the certificate of the open key
> of IdP.

No. Your existing key pair can be used for both encryption and signing
and all of the public keys you publish in SAML metadata for your SAML
SP are for your SAML SP, not for anything else (such as an IDP).

> Am I right? I would be very grateful for the information.

Not yet. Your SP metadata will only have your SP's public key, either
with no 'use' limitation (and only one KeyDescriptor), or by
duplicating the KeyDescriptor with the same certificate in it (!) and
have it with use="signing" once, and again with use="encryption".

You do not put any other keys in your metadata (with "open key of IDP"
you probably mean the IDP's public key, which is none of your SP's
business to publish), only your own, one, public key.
-peter