Can Shibboleth reference IDP cert in separate file?

[Cantor, Scott]

> Is it possible for the Shibboleth SP to reference the IDP x.509 public key in a
> separate file, instead of pasting it inline with the rest of the metadata?

Not in practice.

> The only way I've ever seen this done is inline, which complicates some of our
> attempts to automate key management.

The metadata isn't really for your key management, it's for the management of peer keys, which by intention you wouldn't be the one doing if the metadata was being used as intended. So ultimately this is about what you're doing that isn't what Shibboleth is really meant to be doing.

At the end of the day the metadata is the consumed format unless you're prepared to write C++ to provide it in a different form and there is no syntax in XML Signature that is designed to stick keys in a file except for hacks like an external key reference to a file:/// URL.

When you're managing metadata on behalf of other services, typically you want to be using management tools to produce that metadata, or at least scripts that can do it, like the metagen script the SP comes with. And it happens to pull in the key(s) from the file system.

-- Scott