184 reputation
9
bio website mylifewithjava.blogspot.no
location Norway
age
visits member for 2 years, 3 months
seen May 5 at 12:31

I mainly work with Java development but also does a lot of work with SAML, OpenAM and OpenSAML.

Need help with SAML? Ask me a question on the blogg. http://mylifewithjava.blogspot.no If you're new to SAML and OpenSAML have a look at my book on the subject. http://mylifewithjava.blogspot.co.uk/p/gumroad.html


Apr
24
comment Should I create one key pair per customer as Service Provider in SAML?
Ok, then we agree fully =)
Apr
23
comment Should I create one key pair per customer as Service Provider in SAML?
Ok, in this case the IDP should have one key pair and the SP should have one
Apr
23
comment Should I create one key pair per customer as Service Provider in SAML?
Ok, so are you asking if the IDP can have only one key to communicate with SPs? And the SPs will have one key each?
Apr
22
comment Should I create one key pair per customer as Service Provider in SAML?
Ok, I must have misunderstood your answer. So we agree every SP and IDP should have their own public private key pair. What I understood from your answer you say that all SPs use the same key pair when they start to scale. What was you intention?
Apr
22
comment Should I create one key pair per customer as Service Provider in SAML?
Ok, when you say the customers, you dont mean the users.
Apr
22
comment Should I create one key pair per customer as Service Provider in SAML?
You say "AuthnRequest proves the validity of the issuer of the AuthnRequest" but if everyone has the same private key you can only validate that the issuer is one of the SPs. A propper way to solve this is to let every SP generate and store its own keys. The public part of the key is then delivered to the IDP in SAML metadata
Apr
22
comment Should I create one key pair per customer as Service Provider in SAML?
Client certificates that you assign to the SP and IDP is used mainly to authenticate the SP/IDP. The users typiclly authenticate using password.
Apr
21
answered Should I create one key pair per customer as Service Provider in SAML?
Mar
9
awarded  Tumbleweed
Mar
2
asked Using a website as a middleman for Oauth
Dec
14
accepted OAuth - Why exchange the authcode for a token
Sep
24
awarded  Autobiographer
Sep
13
awarded  Curious
Sep
12
asked OAuth - Why exchange the authcode for a token
May
5
accepted SAML and OpenID, centralized and decentralized
May
5
comment SAML and OpenID, centralized and decentralized
But how can I not care about the authentication in OpenID? I Im going to use the authenticated user in my system I must be able to trust that the OpenID provider authenticates the user correctly. Dont I?
May
5
awarded  Commentator
May
5
comment SAML and OpenID, centralized and decentralized
You say that you dont have a trust relationship with openid providers. Isn't accepting whatever it tells you a typical trust?
May
5
comment SAML and OpenID, centralized and decentralized
Ok, it seams like typically is the keyword here. Bacause with SAML you can have multiple and with OpenID you can choose to trust only one.
May
5
awarded  Custodian