<div dir="ltr"><div>Hi Brent</div><div> </div><div>My interest here is to test some interoperability stuff with AD FS 2.0. Its for use in a lab environment.</div><div> </div><div>So if you could give some instructions, I have a java developer who I can get the help of to follow your instructions and try implement it here.</div>
<div> </div><div>Thanks</div><div> </div><div>M</div><div> </div><div> </div></div><div class="gmail_extra"><br><br><div class="gmail_quote">On 18 April 2013 02:15, Brent Putman <span dir="ltr"><<a href="mailto:putmanb@georgetown.edu" target="_blank">putmanb@georgetown.edu</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class="im"><br>
On 4/17/13 10:13 AM, Cantor, Scott wrote:<br>
><br>
> The schema for the Credential element in the relying-party config appears<br>
> to support a KeyName element. My speculation would be that might cause it<br>
> to be inserted.<br>
<br>
</div>No, that alone won't do it unfortunately. That just lets you attach a key name to the Credential.<br>
The contents of a signature's KeyInfo is based on the config of the KeyInfoGenerator that gets<br>
called to generate a KeyInfo from the Credential. On the default KeyInfoGenerator used throughout<br>
the IdP, the flag to emit the Credential key names is false. So the mere presence of the name on<br>
the Credential won't do it.<br>
<br>
We don't currently expose any way to configure that in the IdP. It can be done with a pretty<br>
simple bean (probably half a dozen lines of Java code) that you'd wire in internal.xml. If the OP's<br>
need is great, I can supply some guidance and/or code. It would also be a global change, there's<br>
currently no framework for per-relying-party config, etc.<br>
<br>
Hopefully this will be more exposed for configuration in v3.<br>
<div class="im"><br>
<br>
><br>
> I actually thought we did include key names generated from a certificate<br>
> already.<br>
><br>
<br>
<br>
</div>No, not by default. The X509KeyInfoGenerator *can* generate key names from the whole subject DN,<br>
the CN of the subject and/or alt names, as well as the key names and entityID set directly on the<br>
Credential (the latter 2 for any basic Credential type). But those options all default to off in<br>
the IdP.<br>
<div class="HOEnZb"><div class="h5"><br>
<br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
</div></div></blockquote></div><br></div>