Shibboleth Developers

[Walter Hoehn <>]

Each physical instance of the IdP software can use many credentials,  
both in the apache vhost setups and in idp.xml for signing.  An  
assumption is made in the IdP configuration that each logical IdP  
uses only one credential for all signing operations pertaining to a  
specific relying party.  A single logical IdP could use different  
credentials for signing and TLS, as long as the metadata is  
configured appropriately.  A <RoleDescriptor/> element, for instance,  
can include multiple <KeyDescriptor/> elements.  I'm not sure what  
you mean by "KeyDescriptor element listed per vhost".

-Walter


On Jun 24, 2005, at 4:06 PM, Tom Scavo wrote:

> Just trying to better understand the example metadata file shipping
> with Shib 1.3.  On the IdP side, there are as many as three different
> credentials that might be specified per vhost (signing, 443, 8443).
> Since there is only one KeyDescriptor element listed per vhost, a
> single credential is being used for all three, correct?
>
> Thanks,
> Tom