509 Certificate in Idp-sp communication

[Rod Widdowson]

Avoiding too much complication, In V2:

1) The IdP Certificate/Key pair in the conf folder is used to *sign* the assertions.  The certificate from this pair should be in the metadata for the IdP (which the SP consumes to check the signature)

2) With one ridiculous exception (which is not relevant and we'll ignore) the IdP metadata is *not* configuration for the IdP.  It is a reflection of the IdP's configuration which allows SPs to communicate with it

3) The IdP will *encrypt* assertions with public key from the metadata of the SP.  The SP has the private key of course and uses that to decrypt the assertions.

So :

> 1) I want to know how <ds:X509Certificate>(idp-meatadata.xml) is used in idp-sp communication
The SP uses it to check that the assertions from the IdP

> 2) This x:509 certificate is using any private key internally?
Yes, to sign the assertion it needs a private key (this will be in the credentials folder in a standard IdP installation),

Does this help?

Rod