<div class="socmaildefaultfont" dir="ltr" style="font-family:Arial, Helvetica, sans-serif;font-size:10.5pt" >
<div dir="ltr" style="font-family:Arial, Helvetica, sans-serif;font-size:10.5pt" >
<div dir="ltr" >Thank you Brandon,</div>
<div dir="ltr" > </div>
<div dir="ltr" >I'll look into that page and consider whether we're going to use architecture 1 or 2 from the attached pdf. </div>
<div dir="ltr" > </div>
<div dir="ltr" >Security wise, I don't like sharing a private key, but it's just isolated to a single service provider. We've given the 3rd party authority with that SP anyway.</div>
<div dir="ltr" > </div>
<div dir="ltr" >
<div dir="ltr" style="font-family:Arial, Helvetica, sans-serif;font-size:10.5pt" >
<div dir="ltr" style="font-family:Arial, Helvetica, sans-serif;font-size:10.5pt" >
<div dir="ltr" >
<div style="font-size: 12pt; font-weight: bold; font-family: sans-serif;" ><font face="Default Sans Serif,Verdana,Arial,Helvetica,sans-serif" size="2" ><font face="Default Sans Serif,Verdana,Arial,Helvetica,sans-serif" size="2" ><font color="#7c7c5f" >Joseph Fischetti</font></font></font></div>
<div style="font-size: 10pt; font-weight: bold; font-family: sans-serif;" ><font face="Default Sans Serif,Verdana,Arial,Helvetica,sans-serif" size="2" ><font face="Default Sans Serif,Verdana,Arial,Helvetica,sans-serif" size="2" >Linux System Administrator</font></font></div>
<div style="font-size: 10pt; font-weight: bold; font-family: sans-serif;" ><font face="Default Sans Serif,Verdana,Arial,Helvetica,sans-serif" size="2" ><font face="Default Sans Serif,Verdana,Arial,Helvetica,sans-serif" size="2" >Marist College</font></font></div>
<div style="font-size: 8pt; font-family: sans-serif; margin-top: 10px;" >
<div><font face="Default Sans Serif,Verdana,Arial,Helvetica,sans-serif" size="2" ><font face="Default Sans Serif,Verdana,Arial,Helvetica,sans-serif" size="2" ><span style="font-weight: bold;" ><font color="#336699" >E-mail: </font></span><a href="mailto:joseph.fischetti@marist.edu" target="_blank" ><font color="#555555" >joseph.fischetti@marist.edu</font></a></font></font></div>
<div> </div>
</div>
</div>
</div>
</div>
</div>
<div dir="ltr" > </div>
<div dir="ltr" > </div>
<blockquote data-history-content-modified="1" dir="ltr" style="border-left:solid #aaaaaa 2px; margin-left:5px; padding-left:5px; direction:ltr; margin-right:0px" >----- Original message -----<br>
From: Brandon McKean <mckeanbs@jmu.edu><br>
Sent by: "users" <users-bounces@shibboleth.net><br>
To: <users@shibboleth.net><br>
Cc:<br>
Subject: Re: Integrating idp3 with cirqlive<br>
Date: Tue, Aug 22, 2017 8:19 AM<br>
<br>
<!--Notes ACF
<meta http-equiv="Content-Type" content="text/html; charset=utf8" >-->
<p>Hi Joseph,</p>
<p>I did this very thing recently. Where you want to look on the wiki is here: <a href="https://wiki.shibboleth.net/confluence/display/IDP30/SecurityConfiguration" target="_blank" >https://wiki.shibboleth.net/confluence/display/IDP30/SecurityConfiguration</a></p>
<p>Specifically, the "Per-Profile Credential" example. It does require adding the information to credentials.xml as well.</p>
<p>Also keep in mind you'll need to adjust the metadata you give to WebEx and CirQlive, to reflect the new keypair you make.</p>
<div><font face="Default Monospace,Courier New,Courier,monospace" size="2" >--<br>
Brandon McKean<br>
IT / Systems<br>
Linux Administrator<br>
(540)568-4235</font></div>
<div>On 08/21/2017 09:54 PM, Joseph Fischetti wrote:</div>
<blockquote cite="mid:OFEFBC1489.C8EEBA16-ON00258184.000A7B70-1503366870414@notes.na.collabserv.com" type="cite" ><!--Notes ACF
<meta http-equiv="Content-Type" content="text/html; charset=utf8" >--><font style="white-space:pre-wrap;font-family: Helvetica Neue, Helvetica, Arial, sans-serif;margin: 1em 0;" >I've been asked to look into integrating cirqlive with our existing IDP 3 installation. Cirqlive adds a link between Sakai and webex sso. During my research I found that cirqlive expects the private key of our IDP so that it can sign the assertions that it sends to WebEx. Obvious security concerns aside, when I reached out to cirqlive for clarification, I received the following PDF in reply. It seems that, given architecture 1 (page 3), they feel that sharing the idp's private key is okay. They also reference using separate keys for different SPs, which as far as im aware, isn't possible with IDP 3. <a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__documentation.cirqlive.com_manuals_SSO_Multi-2DSource-5FSAML-5FAuthentication-5Fwith-5FWebEx-5F-28MEETS-29.pdf&d=DwMFaQ&c=eLbWYnpnzycBCgmb7vCI4uqNEB9RSjOdn_5nBEmmeq0&r=iZ_ekq9_90q96juMacb0Sg&m=-eCch-TyZt4YFZl-wx8BMnYAeOJcS3U-_JfYc5rIQlY&s=m8ewVPb9bdstoz4-yWc4xY8vWLD0vwrKWkx0PdFVXIg&e=" moz-do-not-send="true" target="_blank" >https://documentation.cirqlive.com/manuals/SSO/Multi-Source_SAML_Authentication_with_WebEx_(MEETS).pdf</a> Does anybody else have experience with this? Joseph Fischetti Linux System Administrator Marist College</font>
<fieldset> </fieldset>
</blockquote>
<div><font face="Default Monospace,Courier New,Courier,monospace" size="2" >--<br>
To unsubscribe from this list send an email to users-unsubscribe@shibboleth.net</font></div>
</blockquote>
<div dir="ltr" > </div>
</div>
</div>