<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns:mv="http://macVmlSchemaUri" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Title" content="">
<meta name="Keywords" content="">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"ＭＳ 明朝";}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"Trajan Pro";
panose-1:0 0 0 0 0 0 0 0 0 0;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:Calibri;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:Calibri;
color:windowtext;}
span.msoIns
{mso-style-type:export-only;
mso-style-name:"";
text-decoration:underline;
color:teal;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:Calibri;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1027"/>
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1"/>
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt">Hi everyone,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">This might be the wrong place for this question, and if so let me know and I’ll take it to the appropriate location. I have a question about how SAML messages are encrypted and signed. We are working to
integrate a new service with our Shibboleth Identity Providers. The service has provided us with two sites, a production and a test site, and we have had to upload certificates for both sites to generate the site metadata files. I’ve configured both sites
metadata in our IdP, and I can see both separate certificates listed in this metadata (the ones we generated).<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Here’s where things get strange. I’m troubleshooting an issue with the integration, and I noticed that when I check the the SAML Request from their service provider, it contains a third certificate not generated
by us. Furthermore, it appears that that this certificate is being used to actually encrypt the assertions (though I’m not 100% sure of this, I’ve got a very strong feeling this is the case).<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">So I have a few questions. First off, is there an easy way that I can take a cipher value out of a response and attempt to decrypt it, to verify whether or not our cert of this mysterious third cert is actually
being used for encryption (maybe a mostly copy pasted openssl command), or is there any other validation within the Request/Response to validate which cert was used for encryption? Secondly, can anyone offer insight as to the process that Shibboleth uses
to encrypt and sign assertions? I’m guessing this is probably documented somewhere, so if there is a page explaining this in more detail that someone can point me towards, I’d much appreciate it. I’ve just always been under the impression that the certs
for in the metadata were used for this, and it’s a little confusing to see a certificate offered in the request might actually be responsible.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Tango mike for any information on the above,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Trajan Pro","serif";color:black">Jeff Reynolds</span></b><span style="font-size:11.0pt;font-family:"Times New Roman";color:black"><o:p></o:p></span></p>
<div>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Times New Roman";color:#B94610">Senior Information Security Analyst</span><span style="font-size:11.0pt;font-family:"Times New Roman";color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Times New Roman";color:#B94610">972-883-6828 | <a href="mailto:jreynolds@utdallas.edu"><span style="color:#B94610">jreynolds@utdallas.edu</span></a></span><span style="font-size:11.0pt;font-family:"Times New Roman";color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Times New Roman";color:#B94610"><a href="http://secure-web.cisco.com/1afCCmPALdg8YuA9L0O0t06wOtg6oUwOf27frULVxl6D4hz3F7rZiqOAtTpcdN-LobE-ckT8015ydA9aER611c1CaVtBbMu4_EzfGwuF8zFkhgoZM9QwUYSqIy3pOsTWpensz7zUmLNEusIrRmGqLcgQcptLIzVCi8_pjvs1ZkDmomfcOt0-qeYGcJSbQbyeM/http%3A%2F%2Fwww.utdallas.edu%2Finfosecurity%2F"><span style="color:#B94610">Information
Security Office</span></a></span><span style="font-size:11.0pt;font-family:"Times New Roman";color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Times New Roman";color:black"><a href="http://secure-web.cisco.com/1Cpl8ttBT6ZGunfGnpHes_P09cbe-u9TknUQoTtH8s3Ib-Ksf7gQk5OG94tS227GNQbJLBle-3By0cQFZqCpbyjy0R5KsrPm_kyk0Q2ThKqeUPqC8h8o5S7XzFjmiqcpFGbFJZYFaOEBfrw98cKcOqV5QIX1jYsZU39sP_RwaCn7puMfiQYtPpGdOe3HFtHqX/http%3A%2F%2Fwww.utdallas.edu%2F"><span style="color:#B94610">The
University of Texas at Dallas</span></a></span><span style="font-size:11.0pt;font-family:"Times New Roman";color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Times New Roman";color:black"><a href="http://secure-web.cisco.com/1szYsJ4dNTeYEjpBFxN7WspaYjrR3ILWtiKtLTUNMu_zh_MDZZy2vcPCK-nj_pPyvg2lhG-lX3dz1cGHhoGnRxvq5WBK81YXv7CMTwxa28zxJ_J87QKVu6IThqP-wobIbl6adOD-Iaal04Q4v5lqpOopinaROydDyGogSKFgtXcbqa3Sv5mU_CcLY2LvE5K-e/http%3A%2F%2Futdallas.parature.com%2F"></a></span><!--[if gte vml 1]><v:shapetype id="_x0000_t75" coordsize="21600,21600" o:spt="75" o:preferrelative="t" path="m@4@5l@4@11@9@11@9@5xe" filled="f" stroked="f">
<v:stroke joinstyle="miter"/>
<v:formulas>
<v:f eqn="if lineDrawn pixelLineWidth 0"/>
<v:f eqn="sum @0 1 0"/>
<v:f eqn="sum 0 0 @1"/>
<v:f eqn="prod @2 1 2"/>
<v:f eqn="prod @3 21600 pixelWidth"/>
<v:f eqn="prod @3 21600 pixelHeight"/>
<v:f eqn="sum @0 0 1"/>
<v:f eqn="prod @6 1 2"/>
<v:f eqn="prod @7 21600 pixelWidth"/>
<v:f eqn="sum @8 21600 0"/>
<v:f eqn="prod @7 21600 pixelHeight"/>
<v:f eqn="sum @10 21600 0"/>
</v:formulas>
<v:path o:extrusionok="f" gradientshapeok="t" o:connecttype="rect"/>
<o:lock v:ext="edit" aspectratio="t"/>
</v:shapetype><v:shape id="Picture_x0020_2" o:spid="_x0000_s1026" type="#_x0000_t75" alt="/Users/jjr140030/Library/Containers/com.microsoft.Outlook/Data/Library/Caches/Signatures/signature_624070675" href="http://secure-web.cisco.com/1szYsJ4dNTeYEjpBFxN7WspaYjrR3ILWtiKtLTUNMu_zh_MDZZy2vcPCK-nj_pPyvg2lhG-lX3dz1cGHhoGnRxvq5WBK81YXv7CMTwxa28zxJ_J87QKVu6IThqP-wobIbl6adOD-Iaal04Q4v5lqpOopinaROydDyGogSKFgtXcbqa3Sv5mU_CcLY2LvE5K-e/http%3A%2F%2Futdallas.parature.com%2F" style='position:absolute;margin-left:0;margin-top:0;width:135pt;height:39pt;z-index:251659264;visibility:visible;mso-wrap-style:square;mso-width-percent:0;mso-height-percent:0;mso-wrap-distance-left:9pt;mso-wrap-distance-top:0;mso-wrap-distance-right:9pt;mso-wrap-distance-bottom:0;mso-position-horizontal:left;mso-position-horizontal-relative:text;mso-position-vertical:absolute;mso-position-vertical-relative:line;mso-width-percent:0;mso-height-percent:0;mso-width-relative:page;mso-height-relative:page' o:allowoverlap="f" o:button="t">
<v:imagedata src="file://localhost/Users/jjr140030/Library/Containers/com.microsoft.Outlook/Data/Library/Caches/Signatures/signature_624070675"/>
<w:wrap type="square" anchory="line"/>
</v:shape><![endif]--><![if !vml]><a href="http://secure-web.cisco.com/1szYsJ4dNTeYEjpBFxN7WspaYjrR3ILWtiKtLTUNMu_zh_MDZZy2vcPCK-nj_pPyvg2lhG-lX3dz1cGHhoGnRxvq5WBK81YXv7CMTwxa28zxJ_J87QKVu6IThqP-wobIbl6adOD-Iaal04Q4v5lqpOopinaROydDyGogSKFgtXcbqa3Sv5mU_CcLY2LvE5K-e/http%3A%2F%2Futdallas.parature.com%2F"><img border="0" width="180" height="52" src="file://localhost/Users/jjr140030/Library/Containers/com.microsoft.Outlook/Data/Library/Caches/Signatures/signature_624070675" align="left" hspace="12" title="" v:shapes="Picture_x0020_2"></a><![endif]><a href="http://secure-web.cisco.com/1szYsJ4dNTeYEjpBFxN7WspaYjrR3ILWtiKtLTUNMu_zh_MDZZy2vcPCK-nj_pPyvg2lhG-lX3dz1cGHhoGnRxvq5WBK81YXv7CMTwxa28zxJ_J87QKVu6IThqP-wobIbl6adOD-Iaal04Q4v5lqpOopinaROydDyGogSKFgtXcbqa3Sv5mU_CcLY2LvE5K-e/http%3A%2F%2Futdallas.parature.com%2F"></a><span style="font-size:11.0pt;font-family:"Times New Roman";color:black"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;color:black"><o:p> </o:p></span></p>
</div>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
</div>
</body>
</html>