using cert in SP metadata for encryption

[IAM David Bantz]

Vendor is explicitly using Ping.
Extensive discussion with their technical staff.

On Fri, Nov 18, 2016 at 7:44 AM, Peter Schober <peter.schober at univie.ac.at>
wrote:

> * IAM David Bantz <dabantz at alaska.edu> [2016-11-18 00:19]:
> > FWIW, here's what the SP's metadata looks like:
>
> Note that that metadata is not even well-formed XML (nor XSD
> schema-valid) as it's missing a closing tag for the md:SPSSODescriptor
> element. (May be an artifact of preparing your email, of course.)
>

my artifact, yes; sorry.


> As to the encryption issue: Since the metadata is signed (and includes
> the key its signed with) you could try adding that same certificate as
> a KeyDescriptor to the SP and see whether it will be able to decrypt
> messages using that key. Might be worth a try, if you're managing a
> local copy of their metadata anyway. (It might also be worth trying to
> get that SP to use fully qualified attribute names.)
>

 worth a try, as you suggest, if I can't get proper metadata from the SP

>
> Btw, trying to access https://nextgensso.com/ in a web browser leads
> to an error message with a footer suggesting it's using a Ping
> Identity service or software.


yes, their documentation explicitly states Ping


> I'd be surprised to hear Ping doesn't
> even support encrypted SAML Reponses or Assertions, so if in doubt (as
> you seem to be) ask the vendor/SP.
>

yes, extended discussion with their technical team, who told me they'd
"turned on" encryption
and re-generated the metadata...


> -peter
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20161118/a17c537e/attachment.html>