SP certificate rollover

[Jozef Misutka]

Thank you all for the answers. Because I still do not have the answers, I
will try to rephrase

IdP consumed this metadata:
  <md:KeyDescriptor>
    <ds:KeyInfo>
    <ds:KeyName>Active</ds:KeyName>
...
  <md:KeyDescriptor>
    <ds:KeyInfo>
    <ds:KeyName>Standby</ds:KeyName>

SP has in shibboleth2.xml
   <CredentialResolver type="File" keyName="Active" key=...
   <CredentialResolver type="File" keyName="Standby" key=...

Let a user try to auth. via the IdP to the SP:
1. Will it work?
2. What if Active/Standby are vice versa at one of them?


Another case study, IdP consumed this metadata:
  <md:KeyDescriptor>
    <ds:KeyInfo>
    <ds:KeyName>Active</ds:KeyName>

SP has in shibboleth2.xml
   <CredentialResolver type="File" keyName="Active" key=...
   <CredentialResolver type="File" keyName="Standby" key=...


3. Will it work?
4. What if Active/Standby are vice versa at the SP?

Best,
Jozef























On 3 March 2017 at 15:10, Cantor, Scott <cantor.2 at osu.edu> wrote:

> On 3/3/17, 9:04 AM, "users on behalf of Tom Scavo" <
> users-bounces at shibboleth.net on behalf of trscavo at gmail.com> wrote:
>
> > Right, which is why multiple encryption certificates in metadata is not
> recommended.
>
> As long as the consumer can wield all of them, it's generally fine, and it
> can be quite complex to pull off "multiple signing keys but just one
> encryption key" with a lot of federations. Which I imagine relates to the
> OP's concern. It's very hard to get things to work if there are federations
> imposing constraints.
>
> -- Scott
>
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170303/ec71382b/attachment.html>