InCommon Technical Discussions

["Cantor, Scott" <>]

On 9/6/19, 1:47 PM, "Nick Roy" < on 
behalf of > wrote:

> Please let me know if you have thoughts about what we should be doing with 
> regards to allowing people to specify
> separate key uses/upload multiple keys at once/etc.

I would imagine that in most cases, you want to default an IdP to have one or 
more signing keys, and leave encryption as an after-step, so I wouldn't 
default to dual use.
 
The SP is really just variable. Obviously Shibboleth generates separate keys 
now, but honestly what you really want to do depends on logout support, and I 
think if you're looking for a good default, it would be to encourage 
non-logout supporting SPs to only support encryption and default to that with 
no signing key. That prevents bad decisions from working without extra 
hassle, and people making bad choices don't spend extra time making things 
work. We don't want signing, so don't support it.

If logout is included, it just depends on the implementation and deployment, 
there's no single answer really. Lots of them are going to be one or the 
other and I think you have to ask, and not assume.

-- Scott