<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<br>
<br>
<div class="moz-cite-prefix">On 10/20/15 10:38 AM, Brent Putman
wrote:<br>
</div>
<blockquote cite="mid:562651DA.5090008@georgetown.edu" type="cite">
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
<br>
But just noting that you should be able to have both an EC key
and an RSA key in the SP's metadata, and the IdP will encrypt with
the RSA key.<br>
<br>
I think I also had encryption turned off for my test but I can
easily test that later today. Those really should orthogonal and I
can't foresee any reason why that wouldn't work.. <br>
<br>
</blockquote>
<br>
I just tested that and it works fine. I couldn't remember what
would happen if you didn't mark the SP's EC keys as use="signing",
but turns out that works fine also, since the algorithm and
credential selection will skip those since they aren't valid for
encryption as defined in the software.<br>
<br>
<br>
<blockquote cite="mid:562651DA.5090008@georgetown.edu" type="cite">
Yeah, I had the same question. What toolset, library, etc was
used? If it's something Java-based, then that's hopeful, and
maybe I just screwed something up in my IdP->SP test.<br>
</blockquote>
<br>
<br>
I just re-tested after re-verifying that I was giving the SP the
correct IdP EC cert in the metadata, but it still didn't work. Same
result as before. I guess the next step would be to validate the
IdP's signed response with one or both of those tools that Jarno
mentions, and see what happens. I may not be able to get to that
soon.<br>
<br>
<br>
</body>
</html>