Assurance

[Tom Scavo <>]

>> I would caution you from heading down the path of becoming
>> prescriptive. We worked very hard to remove such requirements
>> recognizing the diversity of our environments.
> 
> Absolutely.  :-)  But something like "you should do something safe
> with your SAML signing keys" might be good to have included by
> reference somewhere.

Something by reference would be okay (https://spaces.internet2.edu/x/E43NAQ), 
but I think a strong positive, non-prescriptive statement is warranted in 
this case. The importance of the IdP's private signing key can not be 
overstated. It trumps everything else.

To avoid having to modify the IAP yet again, what if we incorporated this 
directly into the boarding process for all certified IdPs? We might, for 
example, ask a to-be-certified IdP to generate a new private signing key and 
migrate the corresponding public key certificate into metadata. Does that 
seem reasonable?

We already have a policy that states IdPs "SHOULD generate a new private key 
and submit a certificate with a new public key every 3 years." 
(https://spaces.internet2.edu/x/boY0). Enforcing this policy at the time of 
certification doesn't seem too unreasonable. What do others think?

Tom