sp(2.5.5) <-> idp(3.1.2) and ecdsa certs

[Brent Putman]

On 10/20/15 9:34 AM, Cantor, Scott wrote:
> On 10/20/15, 7:42 AM, "users on behalf of Jarno Huuskonen" <users-bounces at shibboleth.net on behalf of jarno.huuskonen at uef.fi> wrote:
>
>> (I had to disable encryption for that SP in (idp: relying-party.xml),
>> this is probably because xmlenc keytransport algorithms
>> use rsa?:
> Yes, I don't support ECDH encryption.

Neither does the IdP yet [1], hopefully in the near future it will. 
But just noting that you should be able to have both an EC key and an
RSA key in the SP's metadata, and the IdP will encrypt with the RSA key.

I think I also had encryption turned off for my test but I can easily
test that later today. Those really should orthogonal and I can't
foresee any reason why that wouldn't work.. 

>
>> I tested that SP can verify ecdsa signed metadata, so ecdsa signed
>> response probably works.
> Apparently not. What was the metadata signed with?

Yeah, I had the same question.  What toolset, library, etc was used? 
If it's something Java-based, then that's hopeful, and maybe I just
screwed something up in my IdP->SP test.


[1] https://issues.shibboleth.net/jira/browse/OSJ-82



-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20151020/60a82baa/attachment.html>