sp(2.5.5) <-> idp(3.1.2) and ecdsa certs

[Jarno Huuskonen]

On Tue, Oct 20, Cantor, Scott wrote:
> On 10/20/15, 12:27 PM, "users on behalf of Jarno Huuskonen" <users-bounces at shibboleth.net on behalf of jarno.huuskonen at uef.fi> wrote:
> >
> >I can also sign the same metadata with xmlsectool.sh (key/cert in
> >keystore):
> >xmlsectool.sh --sign --inFile unsigned.xml \
> >--referenceIdAttributeName ID \
> >--digest sha-384 --keystore keystore.jks --keyPassword changeit \
> >--keystoreType jks --key uef_metadata --outFile signed.xml
> 
> Does the SP accept that?

No:
2015-10-21 09:17:42 ERROR XMLTooling.ParserPool : error on line 20,
column 15, message: empty content is not valid for content model
'(DSAKeyValue|RSAKeyValue|)'

but if I manually remove:
<ds:KeyValue>
</ds:KeyValue>
from the (xmlsectool.sh) signed metadata then SP validates the metadata.
(line 20 is: </ds:KeyValue>)

(If it helps I can send the metadata file, cert and private key that I
used for metadata signing (cert/key is just for testing)).

-Jarno

-- 
Jarno Huuskonen