users Digest, Vol 77, Issue 112

Wed Nov 29 09:47:11 EST 2017

Hello,

I apologize.

>Which metadata? A meaningless file on disk? Metadata registered witha
federation? Metadata some partner has loaded?

Answer - I am referring to OUR IDP metadata that we give to the SP's.

===========================

Thank You;

Chris Cheltenham
Technology Services
The School District of Philadelphia

Work # 215-400-5025
Cell # 215-301-6571 

-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of
users-request at shibboleth.net
Sent: Wednesday, November 29, 2017 9:35 AM
To: users at shibboleth.net
Subject: users Digest, Vol 77, Issue 112

Send users mailing list submissions to
	users at shibboleth.net

To subscribe or unsubscribe via the World Wide Web, visit
	http://shibboleth.net/mailman/listinfo/users
or, via email, send a message with subject or body 'help' to
	users-request at shibboleth.net

You can reach the person managing the list at
	users-owner at shibboleth.net

When replying, please edit your Subject line so it is more specific than
"Re: Contents of users digest..."

Today's Topics:

   1. SHib 3.2.1 (Cheltenham, Chris)
   2. Re: SHib 3.2.1 (Cantor, Scott)
   3. Re: SHib 3.2.1 (Tom Scavo)

----------------------------------------------------------------------

Message: 1
Date: Wed, 29 Nov 2017 09:22:17 -0500 (EST)
From: "Cheltenham, Chris" <ccheltenham-ext at philasd.org>
To: <users at shibboleth.net>
Subject: SHib 3.2.1
Message-ID: <005001d3691d$75a4f7b0$60eee710$@philasd.org>
Content-Type: text/plain; charset="us-ascii"

Hello,

I inherirted a Shib environment and don't know a whole lot about it.

Its Shib 3.2.1

Does anyone know why there are multiple certificates in our metadata?

There are 5 to be exact

They are all labeled key descriptor.

Like this .

<KeyDescriptor use="signing">

            <ds:KeyInfo>

                    <ds:X509Data>

                        <ds:X509Certificate>

Xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

                        </ds:X509Certificate>

                    </ds:X509Data>

            </ds:KeyInfo>

Thank You;

Chris Cheltenham
Technology Services
The School District of Philadelphia

Work # 215-400-5025
Cell # 215-301-6571 

-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<http://shibboleth.net/pipermail/users/attachments/20171129/523ce996/attac
hment-0001.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image001.gif
Type: image/gif
Size: 1089 bytes
Desc: not available
URL:
<http://shibboleth.net/pipermail/users/attachments/20171129/523ce996/attac
hment-0001.gif>

------------------------------

Message: 2
Date: Wed, 29 Nov 2017 14:34:03 +0000
From: "Cantor, Scott" <cantor.2 at osu.edu>
To: Shib Users <users at shibboleth.net>
Subject: Re: SHib 3.2.1
Message-ID: <2F4C3CBC-1CA7-4732-9EC1-27B91C049882 at osu.edu>
Content-Type: text/plain; charset="utf-8"

On 11/29/17, 9:22 AM, "users on behalf of Cheltenham, Chris"
<users-bounces at shibboleth.net on behalf of ccheltenham-ext at philasd.org>
wrote:

> Does anyone know why there are multiple certificates in our metadata?

Which metadata? A meaningless file on disk? Metadata registered witha
federation? Metadata some partner has loaded?

Metadata has to be given to other partners via a variety of
good/bad/secure/insecure practices ranging from federations like InCommon
or the absolute "never do this" approach of pointing people at unsigned
metadata coming out of the IdP.

There are different keys used for different functions, not all of which
are needed or may be in use. The only near certainty is that you have a
signing key being used and the metadata has to contain it. That assumes
you're actually using one and only one for all partners.

And then there's key rollover and the possibility of pre-communicating
keys before they're put into use.

[1] is the summary of all of this.

Your first step is to read the documentation so you have an understanding
of what all the keys are and are used for, and compare them to what's in
the metadata, but before you can even do that, you have to know how your
metadata is actually communicated to all of your partners. And none of
them should involve any file the IdP generated and if they do, you should
fix that as part of cleaning up this mess. 

-- Scott

[1]
https://wiki.shibboleth.net/confluence/display/IDP30/SecurityAndNetworking

------------------------------

Message: 3
Date: Wed, 29 Nov 2017 09:35:06 -0500
From: Tom Scavo <trscavo at gmail.com>
To: Shib Users <users at shibboleth.net>
Subject: Re: SHib 3.2.1
Message-ID:

<CAEtu=dPQ76uw3OEyCYL3CT7TrD0w3XGeumCjKSMg2Y6-dtFYFw at mail.gmail.com>
Content-Type: text/plain; charset="UTF-8"

On Wed, Nov 29, 2017 at 9:22 AM, Cheltenham, Chris
<ccheltenham-ext at philasd.org> wrote:
>
> Does anyone know why there are multiple certificates in our metadata?

Who knows? They are probably left over from incomplete or failed key
rollover attempts.

> There are 5 to be exact

You don't need that many in any case.

> They are all labeled key descriptor.
>
> <KeyDescriptor use="signing">

The first thing you need to do is determine which of the certificates in
metadata correspond to your private SAML signing key. The rest are
superfluous (assuming your SP partners have the most recent copy of your
metadata).

Is there some reason why your metadata is not published in InCommon?
That would help prevent the situation you're in.

You should start by reading section "Keys and Certificates" in this wiki
page:

SecurityAndNetworking
https://wiki.shibboleth.net/confluence/x/VoEOAQ

HTH,

Tom

------------------------------

Subject: Digest Footer

--
For Consortium Member technical support, see
https://wiki.shibboleth.net/confluence/x/coFAAg
To unsubscribe from this list send an email to
users-unsubscribe at shibboleth.net

------------------------------

End of users Digest, Vol 77, Issue 112
**************************************