Shibboleth Developers

[Ian Young <>]

Lukas Haemmerle wrote:

> This could be useful in our case
> when we want to verify the possession of an SPs private key before we
> let somebody embed e.g. a self-signed certificate.

Can I ask what value you expect that requirement to bring?  We tried to 
think this through for the UK, and we couldn't see that anything bad 
(other than non-functionality) would happen if someone handed us the 
wrong public key... certainly no security issues that we could think of.

The following paper, for example, seems to come to the same conclusion:

   http://middleware.internet2.edu/pki03/presentations/10.pdf

I'm wondering whether you've noticed something we didn't...

        -- Ian