<div dir="ltr"><div class="gmail_extra"><br><div class="gmail_quote">On Thu, Jan 30, 2014 at 9:35 PM, Cantor, Scott <span dir="ltr"><<a href="mailto:cantor.2@osu.edu" target="_blank">cantor.2@osu.edu</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div id=":1ow" style="overflow:hidden">Whatever the SP is asking about, it has nothing to do with a TrustEngine.<br>
That has nothing to do with what somebody else receives.<br></div></blockquote><div><br></div><div>We're talking about front channel stuff.</div><div>The SP in question is NetIQ (Novell) AccessManager.</div><div><br>
</div><div>Their metadata includes separate KeyDescriptors for signing (using a certificate signed by a verisign CA through two layers of intermediaries) and encryption (signed by a CA internal to their novell infrastructure).</div>
<div><br></div><div>Don't we need to set up TrustEngines for validation if they're going to sign or encrypt their assertions?</div><div><br></div><div>Liam</div></div></div></div>