Shibboleth Developers

["Scott Cantor" <>]

> Is there a particular reason why the certs are inline in the  
> metadata? Why not use KeyName to resolve a separate cert?

That sort of indirection is non-standard (requires metadata extensions
defined by the Shibboleth implementation), contextual (depends on the
authorities considered acceptable in a community), and complex (people suck
at PKI, and we're pretty tired of remediating them).

All of those factors lead us to encourage people to use metadata-based
certificate exchange unless and until they're prepared to do something else.
It's much simpler to demonstrate and use on a small scale.

In the case of a tool designed to generate simple metadata reflecting a
peer-to-peer trust arrangement, it would not be appropriate to assume an
external authorities. If people want to do that, they can change the
KeyDescriptor and add a KeyAuthority extension.

-- Scott