Signed

[Nate Klingenstein]

Thanks! So the x.509 is the “signature”.

No, X.509 is an old system designed for PKI.  XML Dsig is the "signature".  The certificates and keys and ASN.1 encoding somehow lived on, but the PKI validation in Shibboleth is preferably done simply by signature evaluation and direct public key comparison.  It can also do PKIX.

Now to look up PKI and why the metada.xml file has the same x.509 info listed twice, once as”signed” and once as “encrypt” (I think)

A provider can use one keypair to sign messages and advertise a distinct public key to receive encrypted messages.  You can also choose to use one keypair for both purposes, in which case you'd list only the one and give it no specific usage constraint.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20140627/16d264d3/attachment.html