SAML 2.0 SP metadata: Purpose and the use of certificate -

-

here part of sp metadata.

reference: metadata oasis security assertion markup language (saml) v2.0

...    <md:keydescriptor use="signing"> <ds:keyinfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">     <ds:x509data>         <ds:x509certificate>         </ds:x509certificate>     </ds:x509data> </ds:keyinfo> </md:keydescriptor> <md:keydescriptor use="encryption"> <ds:keyinfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">     <ds:x509data>         <ds:x509certificate>         </ds:x509certificate>     </ds:x509data> </ds:keyinfo> </md:keydescriptor> ...

are there benefits choose same (or different) certificate in both signing , encryption certificate ?

what purpose of including signing certificate here ?

if message sent through https, transport layer encryption provided. still need include encryption certificate here ?

in saml 2.0 web sso's metadata providers typically declare same certificate both signing , encryption usage.

there use-cases usage of different keys makes sense - e.g. when sp not supposed able decrypt data provided idp (e.g. nameid or attributes), done ultimate recipient of assertion; or when different party provides content creation of assertion party creates saml messages - use-cases rare , more relevant other profiles web sso.

the signing certificate included in order inform users of metadata on how verify messages provided issuer of metadata. example, when sp receives message idp, uses signing certificate defined in idp's metadata in order verify whether message created idp , wasn't tampered during transport.

you typically don't need include encryption certificate in case encryption done on transport layer , don't perform encryption on message level (e.g. of whole message, assertion, nameid or attributes).


Comments

Post a Comment

Popular posts from this blog

javascript - how to protect a flash video from refresh？ -

-
<!doctype html> <html> <head> <meta http-equiv="content-type" content="text/html; charset=utf-8"> <title>flash video refresh</title> </head> <body> <div id="playerzone"><embed height="496" width="580" flashvars="flvid=19742822&amp;createtime=2012-4-19 13:46:33" wmode="opaque" allowscriptaccess="always" allowfullscreen="true" quality="high" bgcolor="#000000" name="player" id="player" src="swf/mine.swf" type="application/x-shockwave-flash"></div> <a onclick="return test();" id="test">click me popup div,and hide scrollbar</a> </body> the code upon： for example,when click a#test button,popup div,it's no problem,but want hide scrollbar while div popup. i used $('html').css('overflow','hidden') in...
Read more

visual studio 2010 - Connect to informix database windows form application -

-
i trying figure out how connect ibm informix database. have been doing research , have found threads 5 years ago examples not working. i have installed latest sdk ibm informix. i have included ibm.data.informix.dll references in project. i have included using ibm.data.informix; i adding button , on click testing conenction. debug error "sql0035n file "c:\users\adam\documents\visual studio 2010\projects\test\test\msg\en_us\db2nmp.xml" cannot opened." this file not exist , dont see anywhere in program files (x86)\ibm informix client sdk directory. my on click code is private void button1_click(object sender, eventargs e) { const string host = "192.168.obfuscated"; const string servicenum = "1525"; //port? const string server = "serverobfuscated"; const string database = "dbobfuscatedy"; const string user = "myusername"; const string password = ...
Read more

android - Associate same looper with different threads -

-
Image
in application, want create multiple threads working on single queue. create queue know need call looper.prepare() . i want other threads create should associated looper created first thread, how can achieve this? use 1 of java thread safe queue class java.util.concurrent package instead of looper achieve goal. it's more common practice. share queue between threads , post task queue entry 1 thread can entry thread. blockingqueue can - in 1 thread call take() , block thread until thread put() entry queue. that's all. producer consumer pattern example blockingqueue or concurrentlinkedqueue about blockingqueue
Read more