SHib 3.2.1

[Cantor, Scott]

On 11/29/17, 9:22 AM, "users on behalf of Cheltenham, Chris" <users-bounces at shibboleth.net on behalf of ccheltenham-ext at philasd.org> wrote:

> Does anyone know why there are multiple certificates in our metadata?

Which metadata? A meaningless file on disk? Metadata registered witha federation? Metadata some partner has loaded?

Metadata has to be given to other partners via a variety of good/bad/secure/insecure practices ranging from federations like InCommon or the absolute "never do this" approach of pointing people at unsigned metadata coming out of the IdP.

There are different keys used for different functions, not all of which are needed or may be in use. The only near certainty is that you have a signing key being used and the metadata has to contain it. That assumes you're actually using one and only one for all partners.

And then there's key rollover and the possibility of pre-communicating keys before they're put into use.

[1] is the summary of all of this.

Your first step is to read the documentation so you have an understanding of what all the keys are and are used for, and compare them to what's in the metadata, but before you can even do that, you have to know how your metadata is actually communicated to all of your partners. And none of them should involve any file the IdP generated and if they do, you should fix that as part of cleaning up this mess. 

-- Scott

[1] https://wiki.shibboleth.net/confluence/display/IDP30/SecurityAndNetworking