SAML Assertion signing and ecryption

[Cantor, Scott]

> 1. can they use the same key for signing and encryption?

Yes. It's common, it's just considered less ideal for key hygiene. Few SPs are skilled enough to properly manage even one private key, so adding a second doesn't exactly help. Key rollover is also hard, but encryption key rolliver is brutally hard, so splitting them has some advantages there.

> 2. we use the metadata generator to generate the metadata file.

You cannot do that. That is always wrong, and it is exactly because of key management that it's wrong. You cannot directly expose the keys used by the configuration into metadata because that makes key rollover impossible. Metadata MUST be curated explicitly, it can only be generated as a one-time example to start from.

> changes needs to be made in the application override in shibboleth2.xml, so
> that it generates a separate key for signing and encryption?

You don't need to, nor does this have anything to do with overrides, you should never use different keys across overrides, it's one system anyway, there's no security advantage to adding more keys.

The metadata generated will be based on whatever CredentialProviders are configured and those providers can carry their own use attributes, as documented, to split signing and encryption.

-- Scott