<font><font face="arial,helvetica,sans-serif">Hello,</font></font><div><font><font face="arial,helvetica,sans-serif"><br></font></font></div><div><span style="font-family:arial,helvetica,sans-serif">one of the SP's that relies on our IdP reported that they will be changing the certificate they use to sign their requests on march 2nd. </span></div>
<div><font><font face="arial,helvetica,sans-serif">Their current certificate is defined in a filesystemmetadataprovider xml file. </font></font></div><div><font><font face="arial,helvetica,sans-serif"><br></font></font></div>
<div><font><font face="arial,helvetica,sans-serif">The </font></font>
<span style="font-family:arial,helvetica,sans-serif">filesystemmetadataprovider </span> contains the following:</div><div><font><br></font></div><div><font><div><md:EntityDescriptor<span class="Apple-tab-span" style="white-space:pre"> </span>xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"<span class="Apple-tab-span" style="white-space:pre"> </span>entityID="someid"><span class="Apple-tab-span" style="white-space:pre"> </span></div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span><md:SPSSODescriptor<span class="Apple-tab-span" style="white-space:pre"> </span>protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol"><span class="Apple-tab-span" style="white-space:pre"> </span></div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span><md:Extensions><span class="Apple-tab-span" style="white-space:pre"> </span></div><div><span class="Apple-tab-span" style="white-space:pre"> </span><DiscoveryResponse<span class="Apple-tab-span" style="white-space:pre"> </span>xmlns="urn:oasis:names:tc:SAML:profiles:SSO:idp-discovery-protocol"<span class="Apple-tab-span" style="white-space:pre"> </span></div>
<div>Binding="urn:oasis:names:tc:SAML:profiles:SSO:idp-discovery-protocol"<span class="Apple-tab-span" style="white-space:pre"> </span></div><div>Location="someurl"<span class="Apple-tab-span" style="white-space:pre"> </span>index="1"/><span class="Apple-tab-span" style="white-space:pre"> </span></div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span></md:Extensions><span class="Apple-tab-span" style="white-space:pre"> </span></div><div><span class="Apple-tab-span" style="white-space:pre"> </span><md:KeyDescriptor<span class="Apple-tab-span" style="white-space:pre"> </span>use="signing"><span class="Apple-tab-span" style="white-space:pre"> </span></div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span><ds:KeyInfo<span class="Apple-tab-span" style="white-space:pre"> </span>xmlns:ds="<a href="http://www.w3.org/2000/09/xmldsig#">http://www.w3.org/2000/09/xmldsig#</a>"><span class="Apple-tab-span" style="white-space:pre"> </span></div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>...</div><div><span class="Apple-tab-span" style="white-space:pre"> </span></ds:KeyInfo><span class="Apple-tab-span" style="white-space:pre"> </span></div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span></md:KeyDescriptor><span class="Apple-tab-span" style="white-space:pre"> </span></div><div><span class="Apple-tab-span" style="white-space:pre"> </span><md:KeyDescriptor<span class="Apple-tab-span" style="white-space:pre"> </span>use="encryption"><span class="Apple-tab-span" style="white-space:pre"> </span></div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span><ds:KeyInfo<span class="Apple-tab-span" style="white-space:pre"> </span>xmlns:ds="<a href="http://www.w3.org/2000/09/xmldsig#">http://www.w3.org/2000/09/xmldsig#</a>"><span class="Apple-tab-span" style="white-space:pre"> </span></div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>...</div><div><span class="Apple-tab-span" style="white-space:pre"> </span></ds:KeyInfo><span class="Apple-tab-span" style="white-space:pre"> </span></div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span></md:KeyDescriptor><span class="Apple-tab-span" style="white-space:pre"> </span></div><div><span class="Apple-tab-span" style="white-space:pre"> </span><md:SingleLogoutService<span class="Apple-tab-span" style="white-space:pre"> </span>Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"<span class="Apple-tab-span" style="white-space:pre"> </span></div>
<div>Location="someurlhere"/><span class="Apple-tab-span" style="white-space:pre"> </span></div><div><span class="Apple-tab-span" style="white-space:pre"> </span><md:ManageNameIDService<span class="Apple-tab-span" style="white-space:pre"> </span>Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"<span class="Apple-tab-span" style="white-space:pre"> </span></div>
<div>Location="someurlhere"/><span class="Apple-tab-span" style="white-space:pre"> </span></div><div><span class="Apple-tab-span" style="white-space:pre"> </span><md:AssertionConsumerService<span class="Apple-tab-span" style="white-space:pre"> </span>Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"<span class="Apple-tab-span" style="white-space:pre"> </span></div>
<div>Location="someurlhere"<span class="Apple-tab-span" style="white-space:pre"> </span>index="0"/><span class="Apple-tab-span" style="white-space:pre"> </span></div><div><span class="Apple-tab-span" style="white-space:pre"> </span></md:SPSSODescriptor><span class="Apple-tab-span" style="white-space:pre"> </span></div>
<div></md:EntityDescriptor><span class="Apple-tab-span" style="white-space:pre"> </span></div><div><br></div><div>I've been searching google but can't seem to find a clear unambiguous an answer to the following question:</div>
</font><div>Now my question is: Can I just add another block like</div><div><div><span class="Apple-tab-span" style="white-space:pre"> </span><md:KeyDescriptor<span class="Apple-tab-span" style="white-space:pre"> </span>use="signing"><span class="Apple-tab-span" style="white-space:pre"> </span></div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span><ds:KeyInfo<span class="Apple-tab-span" style="white-space:pre"> </span>xmlns:ds="<a href="http://www.w3.org/2000/09/xmldsig#">http://www.w3.org/2000/09/xmldsig#</a>"><span class="Apple-tab-span" style="white-space:pre"> </span></div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>...</div><div><span class="Apple-tab-span" style="white-space:pre"> </span></ds:KeyInfo><span class="Apple-tab-span" style="white-space:pre"> </span></div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span></md:KeyDescriptor><span class="Apple-tab-span" style="white-space:pre"> </span></div></div><div>with the new certificate today? </div><div>Or should I wait till march 2nd and then replace the old certificate with the new one? Or is there even something else I should do? </div>
<div>From what I've read in the wiki and on the switch site it appears there's some method in SAML2 to allow 2 certificates to exist at the same time during rollover but I'm not certain these should/can exist in both the SP and the IdP or not. </div>
<div><br></div><div><font color="#000000"><br>
</font><font face="Verdana, Arial, Helvetica, sans-serif" size="1" color="#515151">Kind Regards,<br><br><font size="1" color="#BE1128"><b>JAN KEIRSE</b></font><br><b>CORPORATE SERVICES</b> • <b>Software Engineer</b><br></font></div>
</div>
<br>
<span>DISCLAIMER ****</span><br><br><a href="http://www.tvh.com/newen2/emaildisclaimer/default.html" target="_blank">http://www.tvh.com/newen2/<WBR>emaildisclaimer/default.html</a><span> </span><br><br><span>"This message is delivered to all addressees subject to the conditions</span><br><span>set forth in the attached disclaimer, which is an integral part of this</span><br><span>message."</span>