Signed

[Nate Klingenstein]

Jeff,

Here's the basics on what digital signing means:

http://en.wikipedia.org/wiki/Signature_(cryptography)

There are many things that can be signed in SAML.  The two most common in deployment today with Shibboleth are a signature over the Response object from the IdP with XML DSig and exclusive C14N XML canonicalization(whatever that means; Brent says it all the time) and the entire EntitiesDescriptor element for metadata aggregates.  The first signature is done by the IdP and the second is usually done by a federation.

Hope this helps,
Nate.

On Jun 27, 2014, at 11:37 AM, Jeff Masiello <jmasiello at actionet.com<mailto:jmasiello at actionet.com>>
 wrote:

So,
Complete Newb question.
What, specifically, is signing? You can sign metadata but I thought the metadata (SAML data?) was a signature in itself?
Thanks
Jeff

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20140627/d1990d51/attachment.html