Certificates/Keys revocation on Service Providers

[Cantor, Scott]

On 11/5/15, 5:17 AM, "users on behalf of Marek Denis" <users-bounces at shibboleth.net on behalf of marek.denis at gmail.com> wrote:



>I am wondering how Shibboleth, especially shibd + mod_shib handle keys revocation?

Our supported trust models are described in the wiki in detail [1]. There is no interoperably-defined trust model to use in SAML except for the one I defined and that we use predominantly. That model relies solely on metadata for revocation.

> Suppose I have a setup where I have my Service Provider configured and lots of independent Identity Providers configured. Now,  suppose a certificates of one of trusted IsP has been compromised or a peer wants to replace it with something new. As the latter case can be discussed and some action set at a certain time, the former case needs to be solved as soon as possible (we shouldn block those users immediately).

Then you can up your metadata refresh frequency, or in the case of a dynamic metadata approach, reduce the cache duration.

>How about situation where IdP's certificate has been compromised and my SP should stop trusting this certificate immediately? The most logical way is following:
>a) IdP admin revokes a certificate
>b) when a new assertion arrives, SP's mod_shib/shibd checks with the CA whether certificate has been revoked (each time a request with use of a certificate arrives) and if it has, denies further actions.

We don't use CAs, and checking something online is equivalent to simply updating the metadata, particularly when the metadata is used dynamically. Systems involving traditional revocation don't work like that anyway, they check periodically. How periodically varies but even OCSP isn't usually checked on every single transaction.

>I ma not sure this is default in mod_shib, however I am wondering if
>
>*) There is an option for that in mod_shib/shibd configuration
>*) is above isn't possible as of today whether it's on the roadmap.

When PKIX is used, which is not interoperable and which we do not recommend, there is some limited support in the SP for CRL usage.

-- Scott

[1] https://wiki.shibboleth.net/confluence/display/CONCEPT/TrustManagement