Signed

[Jeff Masiello]

Thanks! So the x.509 is the "signature". Now to look up PKI and why the metada.xml file has the same x.509 info listed twice, once as"signed" and once as "encrypt" (I think)

Jeff Masiello



From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Nate Klingenstein
Sent: Friday, June 27, 2014 1:41 PM
To: Shib Users
Subject: Re: Signed

Jeff,

Here's the basics on what digital signing means:

http://en.wikipedia.org/wiki/Signature_(cryptography)

There are many things that can be signed in SAML.  The two most common in deployment today with Shibboleth are a signature over the Response object from the IdP with XML DSig and exclusive C14N XML canonicalization(whatever that means; Brent says it all the time) and the entire EntitiesDescriptor element for metadata aggregates.  The first signature is done by the IdP and the second is usually done by a federation.

Hope this helps,
Nate.

On Jun 27, 2014, at 11:37 AM, Jeff Masiello <jmasiello at actionet.com<mailto:jmasiello at actionet.com>>
 wrote:


So,
Complete Newb question.
What, specifically, is signing? You can sign metadata but I thought the metadata (SAML data?) was a signature in itself?
Thanks
Jeff

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20140627/b577cf0c/attachment.html