<div dir="ltr">FWIW, here's what the SP's metadata looks like:<div><br></div><div>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" ID="JC4S9BsiLGA0UqAr9y9VYErbnp4" cacheDuration="PT1440M" entityID="<a href="http://nextgensso.com">nextgensso.com</a>"></blockquote><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><span class="gmail-Apple-tab-span" style="white-space:pre"> </span><ds:Signature xmlns:ds="<a href="http://www.w3.org/2000/09/xmldsig#">http://www.w3.org/2000/09/xmldsig#</a>"></blockquote><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><span class="gmail-Apple-tab-span" style="white-space:pre"> </span><ds:SignedInfo></blockquote><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><span class="gmail-Apple-tab-span" style="white-space:pre"> </span><ds:CanonicalizationMethod Algorithm="<a href="http://www.w3.org/2001/10/xml-exc-c14n#">http://www.w3.org/2001/10/xml-exc-c14n#</a>"/></blockquote><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><span class="gmail-Apple-tab-span" style="white-space:pre"> </span><ds:SignatureMethod Algorithm="<a href="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256">http://www.w3.org/2001/04/xmldsig-more#rsa-sha256</a>"/></blockquote><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><span class="gmail-Apple-tab-span" style="white-space:pre"> </span><ds:Reference URI="#JC4S9BsiLGA0UqAr9y9VYErbnp4"></blockquote><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><span class="gmail-Apple-tab-span" style="white-space:pre"> </span><ds:Transforms></blockquote><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><span class="gmail-Apple-tab-span" style="white-space:pre"> </span><ds:Transform Algorithm="<a href="http://www.w3.org/2000/09/xmldsig#enveloped-signature">http://www.w3.org/2000/09/xmldsig#enveloped-signature</a>"/></blockquote><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><span class="gmail-Apple-tab-span" style="white-space:pre"> </span><ds:Transform Algorithm="<a href="http://www.w3.org/2001/10/xml-exc-c14n#">http://www.w3.org/2001/10/xml-exc-c14n#</a>"/></blockquote><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><span class="gmail-Apple-tab-span" style="white-space:pre"> </span></ds:Transforms></blockquote><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><span class="gmail-Apple-tab-span" style="white-space:pre"> </span><ds:DigestMethod Algorithm="<a href="http://www.w3.org/2001/04/xmlenc#sha256">http://www.w3.org/2001/04/xmlenc#sha256</a>"/></blockquote><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><span class="gmail-Apple-tab-span" style="white-space:pre"> </span><ds:DigestValue>...</ds:DigestValue></blockquote><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><span class="gmail-Apple-tab-span" style="white-space:pre"> </span></ds:Reference></blockquote><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><span class="gmail-Apple-tab-span" style="white-space:pre"> </span></ds:SignedInfo></blockquote><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><span class="gmail-Apple-tab-span" style="white-space:pre"> </span><ds:SignatureValue>...</ds:SignatureValue></blockquote><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><span class="gmail-Apple-tab-span" style="white-space:pre"> </span><ds:KeyInfo></blockquote><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><span class="gmail-Apple-tab-span" style="white-space:pre"> </span><ds:X509Data></blockquote><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><span class="gmail-Apple-tab-span" style="white-space:pre"> </span><ds:X509Certificate>...</ds:X509Certificate></blockquote><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><span class="gmail-Apple-tab-span" style="white-space:pre"> </span></ds:X509Data></blockquote><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><span class="gmail-Apple-tab-span" style="white-space:pre"> </span><ds:KeyValue></blockquote><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><span class="gmail-Apple-tab-span" style="white-space:pre"> </span><ds:RSAKeyValue></blockquote><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><span class="gmail-Apple-tab-span" style="white-space:pre"> </span><ds:Modulus>...</ds:Modulus></blockquote><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><span class="gmail-Apple-tab-span" style="white-space:pre"> </span><ds:Exponent>AQAB</ds:Exponent></blockquote><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><span class="gmail-Apple-tab-span" style="white-space:pre"> </span></ds:RSAKeyValue></blockquote><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><span class="gmail-Apple-tab-span" style="white-space:pre"> </span></ds:KeyValue></blockquote><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><span class="gmail-Apple-tab-span" style="white-space:pre"> </span></ds:KeyInfo></blockquote><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><span class="gmail-Apple-tab-span" style="white-space:pre"> </span></ds:Signature></blockquote><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><span class="gmail-Apple-tab-span" style="white-space:pre"> </span><md:SPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol"></blockquote><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><span class="gmail-Apple-tab-span" style="white-space:pre"> </span><md:AssertionConsumerService index="0" Location="<a href="https://nextgensso.com/sp/ACS.saml2">https://nextgensso.com/sp/ACS.saml2</a>" </blockquote></blockquote><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"> Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" isDefault="true"/></blockquote><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><span class="gmail-Apple-tab-span" style="white-space:pre"> </span><md:AttributeConsumingService index="0"></blockquote><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><span class="gmail-Apple-tab-span" style="white-space:pre"> </span><md:ServiceName xml:lang="en">AttributeContract</md:ServiceName></blockquote><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><span class="gmail-Apple-tab-span" style="white-space:pre"> </span><md:RequestedAttribute Name="sn"/></blockquote><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><span class="gmail-Apple-tab-span" style="white-space:pre"> </span><md:RequestedAttribute Name="mail"/></blockquote><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><span class="gmail-Apple-tab-span" style="white-space:pre"> </span><md:RequestedAttribute Name="userId"/></blockquote><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><span class="gmail-Apple-tab-span" style="white-space:pre"> </span><md:RequestedAttribute Name="givenName"/></blockquote><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><span class="gmail-Apple-tab-span" style="white-space:pre"> </span><md:RequestedAttribute Name="StudentID"/></blockquote><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><span class="gmail-Apple-tab-span" style="white-space:pre"> </span></md:AttributeConsumingService></blockquote><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"></md:EntityDescriptor><br></blockquote><div><br></div></blockquote>
</div></div><div class="gmail_extra"><br><div class="gmail_quote">On Thu, Nov 17, 2016 at 12:53 PM, <a href="mailto:db@alaska.edu">db@alaska.edu</a> <span dir="ltr"><<a href="mailto:dabantz@alaska.edu" target="_blank">dabantz@alaska.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Like many SP's metadata I have in bilateral integrations there's neither an explicit signing or encryption use tag.<br>
<br>
The SPs cert is inside a Signing statement, which I haven't seen before.<br>
<br>
<br>
<br>
<a href="mailto:David.Bantz@me.com">David.Bantz@me.com</a><br>
David.Bantz@Alaska.edu<br>
<div class="HOEnZb"><div class="h5"><br>
<br>
> On Nov 17, 2016, at 12:29, John Dennis <<a href="mailto:jdennis@redhat.com">jdennis@redhat.com</a>> wrote:<br>
><br>
>> On 11/17/2016 04:25 PM, Tom Scavo wrote:<br>
>> No, sorry, you have it backwards, I'm afraid. See the Security and<br>
>> Network topic: <a href="https://wiki.shibboleth.net/confluence/x/VoEOAQ" rel="noreferrer" target="_blank">https://wiki.shibboleth.net/<wbr>confluence/x/VoEOAQ</a><br>
><br>
> Thank you Tom, my bad, I confused signing with encryption.<br>
><br>
> --<br>
> John<br>
> --<br>
> To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.<wbr>net</a><br>
</div></div></blockquote></div><br></div>