Shibboleth Developers

[Tom Scavo <>]

On 5/23/05, Scott Cantor 
<>
 wrote:
> > Yes, which seems to suggest separate metadata files for the IdP and SP.
> 
> Why?

Because as you said, the IdP and SP share metadata with each other, so
why wouldn't the IdP's metadata be in one file and the SP's metadata
be in another.  It reinforces the idea that metadata files are swapped
and that an entity need not consume its own metadata.

> >>One or more KeyDescriptors tell SPs how the IdP will authenticate itself. 
> >>A
> >>single descriptor can be used for both signing and for server-TLS.
> >
> > That may be true, but it's not clear by looking at the metadata
> > examples (or even reading the metadata spec) how to write such a
> > KeyDescriptor.  Indeed, it doesn't seem like the 'use' attribute is
> > all that 'use'ful.
> 
> It's not, but then I never claimed it was.

No, but your inline comment says a single descriptor can be used for
both yet it's not clear how to do that.  Moreover, is it required to
duplicate in metadata the KeyInfo that is already in the signature
itself?  I assume it is but that too had me spinning my wheels for a
long time.

Thanks,
Tom