[External] Re: Recommended or "Best" Practices for Shibboleth IdP?

[Cantor, Scott]

On 10/2/20, 3:56 PM, "users on behalf of Shweta Kautia" <users-bounces at shibboleth.net on behalf of skautia at northcarolina.edu> wrote:

>    Perhaps I should state my question very simply -- in this case there is no signing certificate in the SP metadata. What is
> the "best practice" around requiring the SP certificate be included? 

An SP not supporting logout does not need a signing key. An SP supporting logout does. That's it.

People in this thread are also confusing the signing key with the issue of metadata needing to be signed. You don't sign metadata with a SAML sigining key. It's signed by a key trusted out of band to allow the metadata to be verified. They have nothing to do with each other. One is inside a KeyDescriptor element and is metadata content and the other is in a KeyInfo block in a Signature over the metadata document and is metadata "meta-content".

-- Scott