using cert in SP metadata for encryption

[Craig Pluchinsky]

They told us the same thing and I couldn't get things to work.  Just fell 
back to not encrypting.


-------------------------------
Craig Pluchinsky
IT Services
Indiana University of Pennsylvania
724-357-3327


On Fri, 18 Nov 2016, IAM David Bantz wrote:

> Vendor is explicitly using Ping.Extensive discussion with their technical staff.
> 
> On Fri, Nov 18, 2016 at 7:44 AM, Peter Schober <peter.schober at univie.ac.at> wrote:
>       * IAM David Bantz <dabantz at alaska.edu> [2016-11-18 00:19]:
>       > FWIW, here's what the SP's metadata looks like:
>
>       Note that that metadata is not even well-formed XML (nor XSD
>       schema-valid) as it's missing a closing tag for the md:SPSSODescriptor
>       element. (May be an artifact of preparing your email, of course.)
> 
> 
> my artifact, yes; sorry.
>  
>       As to the encryption issue: Since the metadata is signed (and includes
>       the key its signed with) you could try adding that same certificate as
>       a KeyDescriptor to the SP and see whether it will be able to decrypt
>       messages using that key. Might be worth a try, if you're managing a
>       local copy of their metadata anyway. (It might also be worth trying to
>       get that SP to use fully qualified attribute names.)
> 
> 
>  worth a try, as you suggest, if I can't get proper metadata from the SP
>
>       Btw, trying to access https://nextgensso.com/ in a web browser leads
>       to an error message with a footer suggesting it's using a Ping
>       Identity service or software.
> 
> 
> yes, their documentation explicitly states Ping
>  
>       I'd be surprised to hear Ping doesn't
>       even support encrypted SAML Reponses or Assertions, so if in doubt (as
>       you seem to be) ask the vendor/SP.
> 
> 
> yes, extended discussion with their technical team, who told me they'd "turned on" encryption
> and re-generated the metadata...
>  
>       -peter
>
>       --
>       To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
> 
> 
> 
>