IdP Metadata

[Tom Scavo]

Oh shoot, I forgot to add this tip:

Read the Security and Networking topic in the wiki:
https://wiki.shibboleth.net/confluence/x/VoEOAQ

The Keys and Certificates section is particularly relevant.

Tom


On Fri, Jun 24, 2016 at 3:21 PM, Tom Scavo <trscavo at gmail.com> wrote:
> On Fri, Jun 24, 2016 at 2:46 PM, Joel Levin <joel.aaron.levin at gmail.com> wrote:
>>
>> In the default IdP Metadata generated, there are 3 KeyDescriptor elements -
>> 2 x signing, and 1 x encryption.
>>
>> Only 1 is needed?
>
> By eliminating the back channel, you eliminate the need for one of the
> certificates in metadata. You still need a SAML signing certificate
> (use="signing") since that's what an IdP does :-)
>
> An encryption certificate (use="encryption") is optional. There's very
> little practical use for inbound encryption at the IdP, so you can
> probably do without that one as well.
>
> Tom