using cert in SP metadata for encryption

[IAM David Bantz]

FWIW, here's what the SP's metadata looks like:

<md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
>> ID="JC4S9BsiLGA0UqAr9y9VYErbnp4" cacheDuration="PT1440M" entityID="
>> nextgensso.com">
>
> <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
>
> <ds:SignedInfo>
>
> <ds:CanonicalizationMethod Algorithm="
>> http://www.w3.org/2001/10/xml-exc-c14n#"/>
>
> <ds:SignatureMethod Algorithm="
>> http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/>
>
> <ds:Reference URI="#JC4S9BsiLGA0UqAr9y9VYErbnp4">
>
> <ds:Transforms>
>
> <ds:Transform Algorithm="
>> http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
>
> <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
>
> </ds:Transforms>
>
> <ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
>
> <ds:DigestValue>...</ds:DigestValue>
>
> </ds:Reference>
>
> </ds:SignedInfo>
>
> <ds:SignatureValue>...</ds:SignatureValue>
>
> <ds:KeyInfo>
>
> <ds:X509Data>
>
> <ds:X509Certificate>...</ds:X509Certificate>
>
> </ds:X509Data>
>
> <ds:KeyValue>
>
> <ds:RSAKeyValue>
>
> <ds:Modulus>...</ds:Modulus>
>
> <ds:Exponent>AQAB</ds:Exponent>
>
> </ds:RSAKeyValue>
>
> </ds:KeyValue>
>
> </ds:KeyInfo>
>
> </ds:Signature>
>
> <md:SPSSODescriptor
>> protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
>
> <md:AssertionConsumerService index="0" Location="
>> https://nextgensso.com/sp/ACS.saml2"
>
>
>> Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" isDefault="true"/>
>
> <md:AttributeConsumingService index="0">
>
> <md:ServiceName xml:lang="en">AttributeContract</md:ServiceName>
>
> <md:RequestedAttribute Name="sn"/>
>
> <md:RequestedAttribute Name="mail"/>
>
> <md:RequestedAttribute Name="userId"/>
>
> <md:RequestedAttribute Name="givenName"/>
>
> <md:RequestedAttribute Name="StudentID"/>
>
> </md:AttributeConsumingService>
>
> </md:EntityDescriptor>
>>
>
>
On Thu, Nov 17, 2016 at 12:53 PM, db at alaska.edu <dabantz at alaska.edu> wrote:

> Like many SP's metadata I have in bilateral integrations there's neither
> an explicit signing or encryption use tag.
>
> The SPs cert is inside a Signing statement, which I haven't seen before.
>
>
>
> David.Bantz at me.com
> David.Bantz at Alaska.edu
>
>
> > On Nov 17, 2016, at 12:29, John Dennis <jdennis at redhat.com> wrote:
> >
> >> On 11/17/2016 04:25 PM, Tom Scavo wrote:
> >> No, sorry, you have it backwards, I'm afraid. See the Security and
> >> Network topic: https://wiki.shibboleth.net/confluence/x/VoEOAQ
> >
> > Thank you Tom, my bad, I confused signing with encryption.
> >
> > --
> > John
> > --
> > To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20161117/c476df90/attachment-0001.html>