Tag Info

New answers tagged

0

While I have seen a few SPs sign AuthnRequests with unique keys, this doesn't last long as they start to scale. They usually determine that managing all those private keys is a serious pain as they grow larger, and then they switch to using a single private key for signing them. There's nothing wrong with this - signing the AuthnRequest proves that it came ...


0

Best practice is that every IDP and every SP has its own key pair. Easier if you need to issue a new certificate for one of them and it prevents one of them from posing as another etc. But this is the key pairs for the IDP and your web application. You are asking if the customers need different keys. If it is really is a question if the end user should have ...


3

It may be that you need to narrow the scope a little in order to get started. Which aspect of security are you interested in. From the list of standards, you seem more interested in application security & especially in authentication and authorisation? That would be a much easier set of targets to learn at least to begin with. Also, you may need to be ...



Top 50 recent answers are included