509 Certificate in Idp-sp communication

[Surinaidu Majji]

Hello Widdowson Thank you for your reply,
We have the lines in relying-party.xml which are commented out like below.

<!-- security:Credential id="IdPCredential"
xsi:type="security:X509Filesystem" -->
        <!--
security:PrivateKey>d:\IdP/credentials/idp.key</security:PrivateKey-->
        <!--
security:Certificate>d:\IdP/credentials/idp.crt</security:Certificate-->
    <!-- /security:Credential-->
It seems we are not using the above lines in our configuration. but in
"idp-metadata.xml" we have the certificate copied like below:
 <IDPSSODescriptor protocolSupportEnumeration="urn:mace:shibboleth:1.0
urn:oasis:names:tc:SAML:1.1:protocol urn:oasis:names:tc:SAML:2.0:protocol">
<KeyDescriptor>
            <ds:KeyInfo>
                <ds:X509Data>
                    <ds:X509Certificate>

YmcadfjgigAwIBAgIVAIpIZXcZKit2lLeQFAbgX+W9/whiMA0GCSqGSIb3DQEB
BQUAMBgxFjAUBgNVBAMTDWlkcC5zaGFycC5vcmcwHhcNMTMwNTIyMDg1OTMwWhcN
MzMwNTIyMDg1OTMwWjAYMRYwFAYDVQQDEw1pZHAuc2hhcnAub3JnMIIBIjANBgkq
hkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAiM3ExLSHpFizYTzXnv6P0brUIJ9NNFp4
6JIu3TFbmJXI9+Xu/0rJS91quJeUR1Nj6S5pug0858nSjOG/ce/pnxetVBxeI5en
umOPUwBjHMTN4x8Ju8OZVwR5nOOlOMCRIhbcdPy92QiNIQNvoVcg9kzt/xTkO6y6
cmcvaWRwL3NoaWJib2xldGgwHQYDVR0OBBYEFDZNh/kxh9MfDrDWrTYjrkyrKB9L
MA0GCSqGSIb3DQEBBQUAA4IBAQA3gsGr4s8cK9ym8ZZXxuFxVDqxUryeA0E7LSDO
2Z9ThTB51UxS4vgd4kyizQQaT7ZnyHG4Xiv0nwge1zpz5jER7fjzpT4ZlMO1j2vk
+vKkbeOicgxdeF9IIkbp7ruufVVjjveK9PRdYTf6nhQV5ExME7p094anhfeMeuIl
UCwUb+kDoVFeZ2YJe002DlUOM2I6tl3RdXcZ1EBM24pe9KTTLLw2WXDWXL5Yxy9l
hijzw/fm2P7ctqa/iIIqrqUZQXd5PdG42uMXhfsmO0B2pkC370Q4MibB/wjVt7e8
NYIMyebWf4LRO+Lxg2LFXqTs52ecMN8jD6Wjhfdjkhfjkdhfjhdkjfh

                    </ds:X509Certificate>
                </ds:X509Data>
            </ds:KeyInfo>
        </KeyDescriptor>
 </IDPSSODescriptor>

 <AttributeAuthorityDescriptor
protocolSupportEnumeration="urn:oasis:names:tc:SAML:1.1:protocol
urn:oasis:names:tc:SAML:2.0:protocol">
<KeyDescriptor>
            <ds:KeyInfo>
                <ds:X509Data>
                    <ds:X509Certificate>

YmcadfjgigAwIBAgIVAIpIZXcZKit2lLeQFAbgX+W9/whiMA0GCSqGSIb3DQEB
BQUAMBgxFjAUBgNVBAMTDWlkcC5zaGFycC5vcmcwHhcNMTMwNTIyMDg1OTMwWhcN
MzMwNTIyMDg1OTMwWjAYMRYwFAYDVQQDEw1pZHAuc2hhcnAub3JnMIIBIjANBgkq
hkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAiM3ExLSHpFizYTzXnv6P0brUIJ9NNFp4
6JIu3TFbmJXI9+Xu/0rJS91quJeUR1Nj6S5pug0858nSjOG/ce/pnxetVBxeI5en
umOPUwBjHMTN4x8Ju8OZVwR5nOOlOMCRIhbcdPy92QiNIQNvoVcg9kzt/xTkO6y6
cmcvaWRwL3NoaWJib2xldGgwHQYDVR0OBBYEFDZNh/kxh9MfDrDWrTYjrkyrKB9L
MA0GCSqGSIb3DQEBBQUAA4IBAQA3gsGr4s8cK9ym8ZZXxuFxVDqxUryeA0E7LSDO
2Z9ThTB51UxS4vgd4kyizQQaT7ZnyHG4Xiv0nwge1zpz5jER7fjzpT4ZlMO1j2vk
+vKkbeOicgxdeF9IIkbp7ruufVVjjveK9PRdYTf6nhQV5ExME7p094anhfeMeuIl
UCwUb+kDoVFeZ2YJe002DlUOM2I6tl3RdXcZ1EBM24pe9KTTLLw2WXDWXL5Yxy9l
hijzw/fm2P7ctqa/iIIqrqUZQXd5PdG42uMXhfsmO0B2pkC370Q4MibB/wjVt7e8
NYIMyebWf4LRO+Lxg2LFXqTs52ecMN8jD6Wjhfdjkhfjkdhfjhdkjfh

                    </ds:X509Certificate>
                </ds:X509Data>
            </ds:KeyInfo>
        </KeyDescriptor>
 </AttributeAuthorityDescriptor>

As i know that the <ds:X509Certificate> is created by using OpenSSL and the
same has copied over here.
but I think we are not using any of the idp.crt, idp.key file in our
configuration. Is it the another way to configure like this without using
idp.crt, idp.key files.


Thank you for your patience.

On Fri, Mar 27, 2015 at 6:59 PM, Rod Widdowson <rdw at steadingsoftware.com>
wrote:

> > our certificate which is placed in idp-metadata.xml. I think we do not
> need to
> > upgrade shibboleth-idp.jar for this.
>
> I think that was already answered.  Java doesn't use OpenSSL.  OpenSSL
> vulnerabilities will not affect java programs.
>
> > I can able to see only the <ds:X:509 Certificate> certificate in the
> idp-metadata.xml except that i don't see any other keys(pvt key) in
> credentials folder
>
> No idp.key file?  Just the idp.crt file (with similar content to the
> metadata statement).
>
> What does relying-party.xml have to say about your credentials.  Look for
> a line like this
>
>     <security:Credential id="IdPCredential"
> xsi:type="security:X509Filesystem">
>
> That explicitly sets where the key and crt file are being served from.
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20150330/d0a7c0c3/attachment.html