Productionalization of public and private keys for an IdP

[Kirill]

Hi everybody,

Say as a developer I have developed some custom logic for authentication /
authorization of a user, and now somebody else will need to deploy what I
have developed to production environment.

In my test / dev environment I used keys / certs that were generated during
installation, and now the deployment team will naturally need to create /
generate new public / private keys and updated metadata with this keys for
the production use.

So I just want to confirm that the way we plan to do it is correct:

1. The production team generates there own public and private key pairs and
puts them in the
following files (as defined int the idp.properties):

%{idp.home}/credentials/idp-signing.key (private / signing)
%{idp.home}/credentials/idp-signing.crt (public / signing)
%{idp.home}/credentials/idp-encryption.key (private / encryption)
%{idp.home}/credentials/idp-encryption.crt (public / encryption)

2. Then they put the public keys to <KeyDescriptor use="signing" /> and
<KeyDescriptor use="signing" /> elements of metadata and give this updated
metadata to SP.

That would be it?

Thanks,
Kirill
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160322/e28420ff/attachment.html>