sp(2.5.5) <-> idp(3.1.2) and ecdsa certs

[Brent Putman]

On 10/20/15 10:38 AM, Brent Putman wrote:
>
>   But just noting that you should be able to have both an EC key and
> an RSA key in the SP's metadata, and the IdP will encrypt with the RSA
> key.
>
> I think I also had encryption turned off for my test but I can easily
> test that later today. Those really should orthogonal and I can't
> foresee any reason why that wouldn't work.. 
>

I just tested that and it works fine.  I couldn't remember what would
happen if you didn't mark the SP's EC keys as use="signing", but turns
out that works fine also, since the algorithm and credential selection
will skip those since they aren't valid for encryption as defined in the
software.


> Yeah, I had the same question.  What toolset, library, etc was used? 
> If it's something Java-based, then that's hopeful, and maybe I just
> screwed something up in my IdP->SP test.


I just re-tested after re-verifying that I was giving the SP the correct
IdP EC cert in the metadata, but it still didn't work.  Same result as
before.  I guess the next step would be to validate the IdP's signed
response with one or both of those tools that Jarno mentions, and see
what happens.  I may not be able to get to that soon.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20151020/ea845d8c/attachment.html>