<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 14 (filtered medium)"><!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--><div class=WordSection1><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>I’ve had a password set there all along on v 2.3.1 of idp.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>Never and an issue. However today I mistakenly put the wrong password and things still worked which had me concerned.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>However I actually though the purpose of this password was to allow you to sign/encrypt SAML messages using the private key. From what I am hearing that is not the case.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><b><span style='font-size:10.0pt;font-family:"Verdana","sans-serif";color:green'>Matt Zmuda</span></b><b><span style='font-size:10.0pt;font-family:"Verdana","sans-serif";color:#1F497D'> </span></b><span style='font-size:10.0pt;font-family:"Verdana","sans-serif";color:#1F497D'>|<b> </b></span><span style='font-size:10.0pt;font-family:"Verdana","sans-serif";color:#1F497D'>IT Solutions Developer<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Verdana","sans-serif";color:#1F497D'>DCTS Online Channels - Authentication and Security - CIP/ESR<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>From:</span></b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'> Brent Putman [via Shibboleth] [mailto:<a href="/user/SendEmail.jtp?type=node&node=7587463&i=0" target="_top" rel="nofollow" link="external">[hidden email]</a>] <br><b>Sent:</b> Tuesday, June 11, 2013 4:47 PM<br><b>To:</b> Zmuda, Matthew R<br><b>Subject:</b> Re: When is PrivateKey password used?<o:p></o:p></span></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><br>On 6/11/13 1:37 PM, Zmuda, Matthew R wrote: <o:p></o:p></p><div><p class=MsoNormal><div class='shrinkable-quote'><br>> <br>> Looking at the IdPCredentials docs - <br>> <a href="https://wiki.shibboleth.net/confluence/display/SHIB2/IdPCredentials" target="_top" rel="nofollow" link="external">https://wiki.shibboleth.net/confluence/display/SHIB2/IdPCredentials</a><br>> <br>> <br>> <br>> PrivateKey - The private key file for the credential; only one <br>> PrivateKey element is allowed. The PrivateKey element may include a <br>> password attribute with the decryption password for the key. <br>> <br>> <br>> <o:p></o:p></p></div><p class=MsoNormal style='margin-bottom:12.0pt'></div>I was actually just reviewing the XML schema for the config above. Turns <br>out the docs above are not consistent with the schema. I don't know <br>why, but in July 2008 (shib-common r766) the support for the password <br>attribute was removed in the schema. What is now documented would <br>actually be schema-invalid. <br><br>Given that this was done (I believe) after v2 was released and that it <br>is a breaking change, I think this was a mistake. Although since it's <br>gone nearly 5 years without anyone hitting it, I assume nobody actually <br>tries to use the password attribute on a PrivateKey. :-) <br><br>I guess we'll discuss whether to put the support back in the schema, or <br>just leave it and fix the docs. The config parsing code seems to still <br>have the password support, so at first glance it just appears to be the <br>schema that was messed up. <br><br>--Brent <br><br><br><br><br>-- <br>To unsubscribe from this list send an email to <a href="/user/SendEmail.jtp?type=node&node=7587458&i=0" target="_top" rel="nofollow" link="external">[hidden email]</a> <br><br><o:p></o:p></p><div class=MsoNormal align=center style='text-align:center'><hr size=1 width="100%" noshade style='color:#CCCCCC' align=center></div><div><div><p class=MsoNormal><b><span style='font-size:9.0pt;font-family:"Tahoma","sans-serif";color:#444444'>If you reply to this email, your message will be added to the discussion below:<o:p></o:p></span></b></p></div><p class=MsoNormal><span style='font-size:9.0pt;font-family:"Tahoma","sans-serif";color:#444444'><a href="" target="_top" rel="nofollow" link="external">click here</a>.<br><a href="http://shibboleth.1660669.n2.nabble.com/template/NamlServlet.jtp?macro=macro_viewer&id=instant_html%21nabble%3Aemail.naml&base=nabble.naml.namespaces.BasicNamespace-nabble.view.web.template.NabbleNamespace-nabble.view.web.template.NodeNamespace&breadcrumbs=notify_subscribers%21nabble%3Aemail.naml-instant_emails%21nabble%3Aemail.naml-send_instant_email%21nabble%3Aemail.naml" target="_top" rel="nofollow" link="external"><span style='font-size:7.0pt;font-family:"Times New Roman","serif"'>NAML</span></a> <o:p></o:p></span></p></div></div><p><FONT FACE="Arial" style="font-size:8pt;"><br />
NOTICE: Confidential message which may be privileged. Unauthorized use/disclosure prohibited. If received in error, please go to www.td.com/legal for instructions.<br />
AVIS : Message confidentiel dont le contenu peut être privilégié. Utilisation/divulgation interdites sans permission. Si reçu par erreur, prière d'aller au www.td.com/francais/avis_juridique pour des instructions.</FONT></p>
<br/><hr align="left" width="300" />
View this message in context: <a href="http://shibboleth.1660669.n2.nabble.com/When-is-PrivateKey-password-used-tp7587443p7587463.html">RE: When is PrivateKey password used?</a><br/>
Sent from the <a href="http://shibboleth.1660669.n2.nabble.com/Shibboleth-Users-f1660767.html">Shibboleth - Users mailing list archive</a> at Nabble.com.<br/>