OpenSAML user discussion

[shri kanth s <>]

Hi,

     I just had a question related to signing SAML Messages using OpenSaml. 

We are IDP provider and there are several vendors who uses IDP services. When a message is initiated from IDP , IDP signs the message using a private key and the requestor in question validates it using the public key provided to them. When the ServiceProvider posts the SAML message, they will sign using a private key and the IDP/ other Service provider verifies the message usign a public key.

My question relates to

1) Can we use the same keystore at the IDP as well at the service provider end? Which ideally means sharing same private and public key,  What are security implications you can foresee in this scenario?



Thanks,