SP metadata: certificate for signing and encryption

[Peter Schober]

* Alexey <strolling.code at gmail.com> [2014-07-15 13:18]:
> My new metadata have not gotten to the IdP, so I use the old ones that are
> not correct and get the same error - *Unable to encrypt assertion*. When the
> IdP will receive new SP-metadata and if an error occurs, I will write about
> it.

The only use of SP Metadata is to give it to the IDP so the IDP can
configure it's behaviour for the SP based on SAML metadata.
So changing metadata and not giving it to the IDP cannot lead to
changed behaviour at the IDP in itself.

>  Peter Schober wrote
> > You do not put any other keys in your metadata (with "open key of IDP" 
> > you probably mean the IDP's public key, which is none of your SP's 
> > business to publish), only your own, one, public key. 
> 
> I suggested that I need a public key of IdP for perform encrypting of
> requests from SP to IdP.  These requests sent without encryption?

* The IDP publishes it's own public key in SAML metadata.
* The SP publishes it's own public key in SAML metadata.
* If properly exchanged, the IDP and the SP then know the public key of
  the other party.
* That allows each party to encrypt SAML protocol messages to the
  other party, by using the other party's public key. (In practice on
  the IDP encrypts data to the SP.)
* That also allows each party to verify signed messages from the other
  party, using the (a) public key from SAML metadata that either has
  no use restriction or allows use="signing".

That's all there is. SP metadata only has SP keys, IDP metadata only
has IDP metadata. I think I've said that in both of my previous
emails. though, so I suggest STFW for public key encryption.
Nothing here is special to Shibboleth.
-peter