Unknown or Unusable Identity Provider for Shib 3.2 SP

[Cantor, Scott]

> I've been looking at some documentation that suggests
> shibboleth signs by default with a self-signed keypair.

Shibboleth doesn't sign authentication requests by default at all, because it's silly to do so. Signing is done for logout but that's it, unless it's told to do something else.

It generates self-signed keypairs for signing and encryption at install time, but will use any keypairs it's told to use so making assumptions about any of that isn't really possible in a specific case.

I certainly encounter SPs running Shibboleth who are misguided enough to use commercial certificates.

> We have in our shibboleth2.xml `<CredentialResolver
> type="File" key="cert/sp-key.pem" certificate="cert/sp
>-cert.pem"/>` which looks like it makes sense, as long as the
> paths to the cert and key are valid.

Those are not the paths it will load them from in the default configuration, so if nothing else it means that the defaults are not in use, and that opens up the possibility of other differences (probably explaining the unnecessary signing it's doing).

Another difference is that that's apparently a single keypair and the SP hasn't defaulted to one for both uses in many years, it generates one for signing and one for encryption, with distinct names.

-- Scott