Shibboleth Developers

[Noah Levitt <>]

Hello,

Are these observations about trust.xml as it's used in the
shib implementation correct?

 1. In a <KeyAuthority> the <ds:KeyName> must correspond
    to a providerId. Putting a DN or a CN in there never got
    it to match anything for me.
 2. Putting a cert in a <ds:KeyInfo> and outside a
    <KeyAuthority> does not make the shar trust anything.
    (What is the purpose of <ds:KeyInfo> outside of
    <KeyAuthority>?)
 3. The most specific providerId for a given relying party
    that matches a <ds:KeyName> is the only KeyAuthority
    tried when matching a cert. So if relying party has its
    own <KeyAuthority>, but there is also another
    <KeyAuthority> for the federation of which the IdP is a
    member, only the former will be used. Also, if the same
    <ds:KeyName> appears in multiple <KeyAuthority>s, only
    the first match will be used, others will be ignored. 

Perhaps these things, or the relevant correct information if
this stuff is wrong, could be documented?

Noah