IdP Metadata

[Tom Scavo]

On Fri, Jun 24, 2016 at 2:46 PM, Joel Levin <joel.aaron.levin at gmail.com> wrote:
>
> In the default IdP Metadata generated, there are 3 KeyDescriptor elements -
> 2 x signing, and 1 x encryption.
>
> Only 1 is needed?

By eliminating the back channel, you eliminate the need for one of the
certificates in metadata. You still need a SAML signing certificate
(use="signing") since that's what an IdP does :-)

An encryption certificate (use="encryption") is optional. There's very
little practical use for inbound encryption at the IdP, so you can
probably do without that one as well.

Tom