Certificates/Keys revocation on Service Providers

[Marek Denis]

Hello,

I am wondering how Shibboleth, especially shibd + mod_shib handle keys
revocation? Suppose I have a setup where I have my Service Provider
configured and lots of independent Identity Providers configured. Now,
 suppose a certificates of one of trusted IsP has been compromised or a
peer wants to replace it with something new. As the latter case can be
discussed and some action set at a certain time, the former case needs to
be solved as soon as possible (we shouldn block those users immediately).


As far as I am concerned the idp metadatas are being removed every X
seconds, which default to 3600 (1h)  so IdP administrator who wishes to
replace certificates just needs to do at his side and change will be
propagated next time mod_shib/shibd polls IdP's metadata.
How about situation where IdP's certificate has been compromised and my SP
should stop trusting this certificate immediately? The most logical way is
following:


a) IdP admin revokes a certificate
b) when a new assertion arrives, SP's mod_shib/shibd checks with the CA
whether certificate has been revoked (each time a request with use of a
certificate arrives) and if it has, denies further actions.

I ma not sure this is default in mod_shib, however I am wondering if

*) There is an option for that in mod_shib/shibd configuration
*) is above isn't possible as of today whether it's on the roadmap.

Thanks for all the explanations!

-- 
Marek Denis
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20151105/93acae62/attachment-0001.html>