<div dir="ltr"><div>We have developed a web application which has Shibboleth sso support. We are using shibboleth-idp.jar, opensaml.jar but not using shibboleth SP.We have our applications as our SP&#39;s. Currently we are about to look into the openssl issues which were occured recently as all we know.According to my knowledge openssl can not effect idp(java implementation) which we are using but it will effect SP but we are not using Shibboleth SP. Our collegues have set up the shibboleth sso which i do not know complete background.</div><div><br></div><div>They have put the public key(can i call public key or public certificate) in idp-metadata.xml by creating using Openssl and they did</div><div>not put any key custom-sp-metadata.xml(own SP),</div><div><br></div><div>idp-metadata.xml:</div><div>================ </div><div><br></div><div> &lt;IDPSSODescriptor protocolSupportEnumeration=&quot;urn:mace:shibboleth:1.0 urn:oasis:names:tc:SAML:1.1:protocol urn:oasis:names:tc:SAML:2.0:protocol&quot;&gt;</div><div><br></div><div>        &lt;Extensions&gt;</div><div>            &lt;shibmd:Scope regexp=&quot;false&quot;&gt;<a href="http://demo.org">demo.org</a>&lt;/shibmd:Scope&gt;</div><div>        &lt;/Extensions&gt;</div><div><br></div><div>        &lt;KeyDescriptor&gt;</div><div>            &lt;ds:KeyInfo&gt;</div><div>                &lt;ds:X509Data&gt;</div><div>                    &lt;ds:X509Certificate&gt;</div><div><br></div><div>kjdfkhdkfIIDIDCCAgigAwIBAgIVAIpIZXcZKit2lLeQFAbgX+W9/whiMA0GCSqGSIb3DQEB</div><div>BQUAMBgxFjAUBgNVBAMTDWlkcC5zaGFycC5vcmcwHhcNMTMwNTIyMDg1OTMwWhcN</div><div>MzMwNTIyMDg1OTMwWjAYMRYwFAYDVQQDEw1pZHAuc2hhcnAub3JnMIIBIjANBgkq</div><div>hkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAiM3ExLSHpFizYTzXnv6P0brUIJ9NNFp4</div><div>6JIu3TFbmJXI9+Xu/0rJS91quJeUR1Nj6S5pug0858nSjOG/ce/pnxetVBxeI5en</div><div>umOPUwBjHMTN4x8Ju8OZVwR5nOOlOMCRIhbcdPy92QiNIQNvoVcg9kzt/xTkO6y6</div><div>QgoL7twioIzBto9OugNMmsfYLKN8Zlc+jlvPpctOXVRM3AcC3v7DiBj4Q2KwIpof</div><div>qHWu8PUX7ru9H4RDAal4FXw/PU76LP2yZvIVwfh/KzTbkFLFk1/5u32RH2DMLviW</div><div>M6ezvkqgj3WHvToXInpynntZpr9rerKxdx+GHYA6pGLyVi/DslAlHQIDAQABo2Ew</div><div>jdsfhjkdhfkhdjkfhjksdhfjk hdiofh876876defjsdklf7dkfjkdjfkdfkjdk/</div><div>MA0GCSqGSIb3DQEBBQUAA4IBAQA3gsGr4s8cK9ym8ZZXxuFxVDqxUryeA0E7LSDO</div><div>2Z9ThTB51UxS4vgd4kyizQQaT7ZnyHG4Xiv0nwge1zpz5jER7fjzpT4ZlMO1j2vk</div><div>+vKkbeOicgxdeF9IIkbp7ruufVVjjveK9PRdYTf6nhQV5ExME7p094anhfeMeuIl</div><div>UCwUb+kDoVFeZ2YJe002DlUOM2I6tl3RdXcZ1EBM24pe9KTTLLw2WXDWXL5Yxy9l</div><div><br></div><div><br></div><div>                    &lt;/ds:X509Certificate&gt;</div><div>                &lt;/ds:X509Data&gt;</div><div>            &lt;/ds:KeyInfo&gt;</div><div>        &lt;/KeyDescriptor&gt;        </div><div>    &lt;/IDPSSODescriptor&gt; </div><div> &lt;AttributeAuthorityDescriptor protocolSupportEnumeration=&quot;urn:oasis:names:tc:SAML:1.1:protocol urn:oasis:names:tc:SAML:2.0:protocol&quot;&gt;</div><div><br></div><div>        &lt;Extensions&gt;</div><div>            &lt;shibmd:Scope regexp=&quot;false&quot;&gt;<a href="http://demo.org">demo.org</a>&lt;/shibmd:Scope&gt;</div><div>        &lt;/Extensions&gt;</div><div><br></div><div>        &lt;KeyDescriptor&gt;</div><div>            &lt;ds:KeyInfo&gt;</div><div>                &lt;ds:X509Data&gt;</div><div>                    &lt;ds:X509Certificate&gt;</div><div><br></div><div>kjdfkhdkfIIDIDCCAgigAwIBAgIVAIpIZXcZKit2lLeQFAbgX+W9/whiMA0GCSqGSIb3DQEB</div><div>BQUAMBgxFjAUBgNVBAMTDWlkcC5zaGFycC5vcmcwHhcNMTMwNTIyMDg1OTMwWhcN</div><div>MzMwNTIyMDg1OTMwWjAYMRYwFAYDVQQDEw1pZHAuc2hhcnAub3JnMIIBIjANBgkq</div><div>hkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAiM3ExLSHpFizYTzXnv6P0brUIJ9NNFp4</div><div>6JIu3TFbmJXI9+Xu/0rJS91quJeUR1Nj6S5pug0858nSjOG/ce/pnxetVBxeI5en</div><div>umOPUwBjHMTN4x8Ju8OZVwR5nOOlOMCRIhbcdPy92QiNIQNvoVcg9kzt/xTkO6y6</div><div>QgoL7twioIzBto9OugNMmsfYLKN8Zlc+jlvPpctOXVRM3AcC3v7DiBj4Q2KwIpof</div><div>qHWu8PUX7ru9H4RDAal4FXw/PU76LP2yZvIVwfh/KzTbkFLFk1/5u32RH2DMLviW</div><div>M6ezvkqgj3WHvToXInpynntZpr9rerKxdx+GHYA6pGLyVi/DslAlHQIDAQABo2Ew</div><div>jdsfhjkdhfkhdjkfhjksdhfjk hdiofh876876defjsdklf7dkfjkdjfkdfkjdk/</div><div>MA0GCSqGSIb3DQEBBQUAA4IBAQA3gsGr4s8cK9ym8ZZXxuFxVDqxUryeA0E7LSDO</div><div>2Z9ThTB51UxS4vgd4kyizQQaT7ZnyHG4Xiv0nwge1zpz5jER7fjzpT4ZlMO1j2vk</div><div>+vKkbeOicgxdeF9IIkbp7ruufVVjjveK9PRdYTf6nhQV5ExME7p094anhfeMeuIl</div><div>UCwUb+kDoVFeZ2YJe002DlUOM2I6tl3RdXcZ1EBM24pe9KTTLLw2WXDWXL5Yxy9l</div><div><br></div><div>                    &lt;/ds:X509Certificate&gt;</div><div>                &lt;/ds:X509Data&gt;</div><div>            &lt;/ds:KeyInfo&gt;</div><div>        &lt;/KeyDescriptor&gt;  </div><div>    &lt;/AttributeAuthorityDescriptor&gt;</div><div><br></div><div><br></div><div>custom-metadata.xml:(No x509-certificate)</div><div>===================</div><div> &lt;md:SPSSODescriptor protocolSupportEnumeration=&quot;urn:oasis:names:tc:SAML:1.1:protocol urn:oasis:names:tc:SAML:2.0:protocol&quot;&gt;</div><div><br></div><div>    &lt;md:KeyDescriptor&gt;</div><div>      &lt;ds:KeyInfo&gt;</div><div>        &lt;ds:X509Data&gt;</div><div>          &lt;ds:X509Certificate&gt;</div><div>          &lt;/ds:X509Certificate&gt;</div><div>        &lt;/ds:X509Data&gt;</div><div>      &lt;/ds:KeyInfo&gt;</div><div>    &lt;/md:KeyDescriptor&gt;</div><div>  &lt;/md:SPSSODescriptor&gt;</div><div> </div><div><br></div><div>In the communication of idp-sp, idp has &lt;ds:x:509-certificate&gt; but custom-metadata.xml does not have any thing(&lt;ds:X509Certificate&gt;</div><div>          &lt;/ds:X509Certificate&gt;). I am not able to figure out how idp-sp saml message messages are encrypted.</div><div>1) I want to know how &lt;ds:X509Certificate&gt;(idp-meatadata.xml) is used in idp-sp communication</div><div>2) This x:509 certificate is using any private key internally?</div><div><br></div><div>I have gone through shibboleth docs but i am not able to understand how it is was configured in my application.</div><div><br></div><div>Please help to sort out issues reported by Openssl because we have created &lt;ds:X509Certificate&gt; in idp-metadata.xml by using openssl.</div><div><br></div><div>Kindly let me know if any other inforamtion required from my side to sort it out.</div></div>