509 Certificate in Idp-sp communication

[Surinaidu Majji]

Thank you for the great information. It helped me a lot to understand
communication. You are saying
  to sign the assertion it needs a private key (this will be in the
credentials folder in a standard IdP installation). Actually we have that
folder(credentials) which is empty. If you see my query which i have
mentioned that *SP *is our own.

Recently Openssl announced that some of issues openssl vulnerabilities
<https://www.openssl.org/news/vulnerabilities.html>, to avoid those issues
we have to update
our certificate which is placed in idp-metadata.xml. I think we do not need
to upgrade shibboleth-idp.jar for this.
So we have to create certificate again with the latest openssl version to
avoid openssl vulnerabilities.

I can able to see only the <ds:X:509 Certificate> certificate in the
idp-metadata.xml except that i don't see any other keys(pvt key) in
credentials folder. I don't see any IdP Certificate/Key pair in the conf
folder. We have only .xml configuration files in the *conf* folder. we are
not using *login.config *file from the *conf folder.*

I am able to see only one certificate which in idp-metadata.xml not more.

I hope you can understand my scenario. Please help me.

Thanks a lot for your valuable time.

On Fri, Mar 27, 2015 at 5:02 PM, Rod Widdowson <rdw at steadingsoftware.com>
wrote:

> > > With one ridiculous exception (which is not relevant and we'll ignore)
> the IdP
> > metadata is *not* configuration for the IdP.
> >
> > Okay, I'll bite, can you elaborate on this?
>
> Artifact configuration.  In V2 the IdP reaches into its own metadata to
> find
> out what it should be doing.  We killed that in V3, Scott got to lead the
> ceremony.
>
>
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20150327/0462256f/attachment-0001.html