X:509 Certificate in Idp-sp communication

[Surinaidu Majji]

We have developed a web application which has Shibboleth sso support. We
are using shibboleth-idp.jar, opensaml.jar but not using shibboleth SP.We
have our applications as our SP's. Currently we are about to look into the
openssl issues which were occured recently as all we know.According to my
knowledge openssl can not effect idp(java implementation) which we are
using but it will effect SP but we are not using Shibboleth SP. Our
collegues have set up the shibboleth sso which i do not know complete
background.

They have put the public key(can i call public key or public certificate)
in idp-metadata.xml by creating using Openssl and they did
not put any key custom-sp-metadata.xml(own SP),

idp-metadata.xml:
================

 <IDPSSODescriptor protocolSupportEnumeration="urn:mace:shibboleth:1.0
urn:oasis:names:tc:SAML:1.1:protocol urn:oasis:names:tc:SAML:2.0:protocol">

        <Extensions>
            <shibmd:Scope regexp="false">demo.org</shibmd:Scope>
        </Extensions>

        <KeyDescriptor>
            <ds:KeyInfo>
                <ds:X509Data>
                    <ds:X509Certificate>

kjdfkhdkfIIDIDCCAgigAwIBAgIVAIpIZXcZKit2lLeQFAbgX+W9/whiMA0GCSqGSIb3DQEB
BQUAMBgxFjAUBgNVBAMTDWlkcC5zaGFycC5vcmcwHhcNMTMwNTIyMDg1OTMwWhcN
MzMwNTIyMDg1OTMwWjAYMRYwFAYDVQQDEw1pZHAuc2hhcnAub3JnMIIBIjANBgkq
hkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAiM3ExLSHpFizYTzXnv6P0brUIJ9NNFp4
6JIu3TFbmJXI9+Xu/0rJS91quJeUR1Nj6S5pug0858nSjOG/ce/pnxetVBxeI5en
umOPUwBjHMTN4x8Ju8OZVwR5nOOlOMCRIhbcdPy92QiNIQNvoVcg9kzt/xTkO6y6
QgoL7twioIzBto9OugNMmsfYLKN8Zlc+jlvPpctOXVRM3AcC3v7DiBj4Q2KwIpof
qHWu8PUX7ru9H4RDAal4FXw/PU76LP2yZvIVwfh/KzTbkFLFk1/5u32RH2DMLviW
M6ezvkqgj3WHvToXInpynntZpr9rerKxdx+GHYA6pGLyVi/DslAlHQIDAQABo2Ew
jdsfhjkdhfkhdjkfhjksdhfjk hdiofh876876defjsdklf7dkfjkdjfkdfkjdk/
MA0GCSqGSIb3DQEBBQUAA4IBAQA3gsGr4s8cK9ym8ZZXxuFxVDqxUryeA0E7LSDO
2Z9ThTB51UxS4vgd4kyizQQaT7ZnyHG4Xiv0nwge1zpz5jER7fjzpT4ZlMO1j2vk
+vKkbeOicgxdeF9IIkbp7ruufVVjjveK9PRdYTf6nhQV5ExME7p094anhfeMeuIl
UCwUb+kDoVFeZ2YJe002DlUOM2I6tl3RdXcZ1EBM24pe9KTTLLw2WXDWXL5Yxy9l


                    </ds:X509Certificate>
                </ds:X509Data>
            </ds:KeyInfo>
        </KeyDescriptor>
    </IDPSSODescriptor>
 <AttributeAuthorityDescriptor
protocolSupportEnumeration="urn:oasis:names:tc:SAML:1.1:protocol
urn:oasis:names:tc:SAML:2.0:protocol">

        <Extensions>
            <shibmd:Scope regexp="false">demo.org</shibmd:Scope>
        </Extensions>

        <KeyDescriptor>
            <ds:KeyInfo>
                <ds:X509Data>
                    <ds:X509Certificate>

kjdfkhdkfIIDIDCCAgigAwIBAgIVAIpIZXcZKit2lLeQFAbgX+W9/whiMA0GCSqGSIb3DQEB
BQUAMBgxFjAUBgNVBAMTDWlkcC5zaGFycC5vcmcwHhcNMTMwNTIyMDg1OTMwWhcN
MzMwNTIyMDg1OTMwWjAYMRYwFAYDVQQDEw1pZHAuc2hhcnAub3JnMIIBIjANBgkq
hkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAiM3ExLSHpFizYTzXnv6P0brUIJ9NNFp4
6JIu3TFbmJXI9+Xu/0rJS91quJeUR1Nj6S5pug0858nSjOG/ce/pnxetVBxeI5en
umOPUwBjHMTN4x8Ju8OZVwR5nOOlOMCRIhbcdPy92QiNIQNvoVcg9kzt/xTkO6y6
QgoL7twioIzBto9OugNMmsfYLKN8Zlc+jlvPpctOXVRM3AcC3v7DiBj4Q2KwIpof
qHWu8PUX7ru9H4RDAal4FXw/PU76LP2yZvIVwfh/KzTbkFLFk1/5u32RH2DMLviW
M6ezvkqgj3WHvToXInpynntZpr9rerKxdx+GHYA6pGLyVi/DslAlHQIDAQABo2Ew
jdsfhjkdhfkhdjkfhjksdhfjk hdiofh876876defjsdklf7dkfjkdjfkdfkjdk/
MA0GCSqGSIb3DQEBBQUAA4IBAQA3gsGr4s8cK9ym8ZZXxuFxVDqxUryeA0E7LSDO
2Z9ThTB51UxS4vgd4kyizQQaT7ZnyHG4Xiv0nwge1zpz5jER7fjzpT4ZlMO1j2vk
+vKkbeOicgxdeF9IIkbp7ruufVVjjveK9PRdYTf6nhQV5ExME7p094anhfeMeuIl
UCwUb+kDoVFeZ2YJe002DlUOM2I6tl3RdXcZ1EBM24pe9KTTLLw2WXDWXL5Yxy9l

                    </ds:X509Certificate>
                </ds:X509Data>
            </ds:KeyInfo>
        </KeyDescriptor>
    </AttributeAuthorityDescriptor>


custom-metadata.xml:(No x509-certificate)
===================
 <md:SPSSODescriptor
protocolSupportEnumeration="urn:oasis:names:tc:SAML:1.1:protocol
urn:oasis:names:tc:SAML:2.0:protocol">

    <md:KeyDescriptor>
      <ds:KeyInfo>
        <ds:X509Data>
          <ds:X509Certificate>
          </ds:X509Certificate>
        </ds:X509Data>
      </ds:KeyInfo>
    </md:KeyDescriptor>
  </md:SPSSODescriptor>


In the communication of idp-sp, idp has <ds:x:509-certificate> but
custom-metadata.xml does not have any thing(<ds:X509Certificate>
          </ds:X509Certificate>). I am not able to figure out how idp-sp
saml message messages are encrypted.
1) I want to know how <ds:X509Certificate>(idp-meatadata.xml) is used in
idp-sp communication
2) This x:509 certificate is using any private key internally?

I have gone through shibboleth docs but i am not able to understand how it
is was configured in my application.

Please help to sort out issues reported by Openssl because we have created
<ds:X509Certificate> in idp-metadata.xml by using openssl.

Kindly let me know if any other inforamtion required from my side to sort
it out.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20150327/55d71a7d/attachment.html