<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<p><br>
</p>
<div class="moz-cite-prefix">On 4/10/25 2:04 PM, Cantor, Scott via
users wrote:<br>
</div>
<blockquote type="cite"
cite="mid:2118F325-0A12-4F83-B495-F32DAF367187@osu.edu"><br>
<pre class="moz-quote-pre" wrap="">Doing that with a symmetric key is called key wrapping, and it's in the spec. I think OpenSAML has support for it, but I doubt we have any of the wiring done to permit it since it's insane in this context.</pre>
</blockquote>
<p><br>
</p>
<p>We definitely support symmetric key wrap and those things from
the XML Encryption spec.</p>
<p>In the IdP what you'd need then is support for building a
Credential with the key on disk, and I seem to remember
implementing something like that, i.e. reading the base64-encoded
bits of a symmetric key. Not 100% sure though. Paul, if you really
want to try and support it with that SP, I can look to confirm
that.</p>
<p>For the record this would be the first SP I've personally heard
of requiring (or even supporting!) use of symmetric key wrap vs
public key.<br>
</p>
<br>
<blockquote type="cite"
cite="mid:2118F325-0A12-4F83-B495-F32DAF367187@osu.edu">
<pre class="moz-quote-pre" wrap="">
</pre>
<blockquote type="cite">
<pre class="moz-quote-pre" wrap="">BTW, in order to shame the guilty the product in question is
Blue from Explorance. Interestingly, we already had a
perfectly functional integration with them, but they're
"upgrading" their SAML support, and we're running into this
issue trying to stand up their dev platform...
</pre>
</blockquote>
<pre class="moz-quote-pre" wrap="">
It's Explorant I think, OSU uses it. They used Shibboleth, so of course this will be a drastic improvement, but at least they don't have to use my horrible code anymore.</pre>
</blockquote>
<p><br>
</p>
<p>GU also uses Explorance Blue. I wasn't involved in the SAML
setup, however, and haven't heard if we are being asked to
re-configure things yet.<br>
</p>
</body>
</html>