{"action":"created","issue":{"url":"https://api.github.com/repos/onelogin/python-saml/issues/102","labels_url":"https://api.github.com/repos/onelogin/python-saml/issues/102/labels{/name}","comments_url":"https://api.github.com/repos/onelogin/python-saml/issues/102/comments","events_url":"https://api.github.com/repos/onelogin/python-saml/issues/102/events","html_url":"https://github.com/onelogin/python-saml/issues/102","id":122368968,"number":102,"title":"Certificate choice for signing and validation","user":{"login":"sidprak","id":1428486,"avatar_url":"https://avatars.githubusercontent.com/u/1428486?v=3","gravatar_id":"","url":"https://api.github.com/users/sidprak","html_url":"https://github.com/sidprak","followers_url":"https://api.github.com/users/sidprak/followers","following_url":"https://api.github.com/users/sidprak/following{/other_user}","gists_url":"https://api.github.com/users/sidprak/gists{/gist_id}","starred_url":"https://api.github.com/users/sidprak/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sidprak/subscriptions","organizations_url":"https://api.github.com/users/sidprak/orgs","repos_url":"https://api.github.com/users/sidprak/repos","events_url":"https://api.github.com/users/sidprak/events{/privacy}","received_events_url":"https://api.github.com/users/sidprak/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2015-12-15T21:20:51Z","updated_at":"2015-12-16T01:14:38Z","closed_at":null,"body":"We currently use this library on our SP and integrate with a wide array of IDPs including ADFS. We noticed that the library makes an explicit choice about whether to use the SP or IDP cert for certain cases, for example:\r\n* AuthN request signing - SP cert\r\n* ACS request validation - IDP cert\r\n* Logout request signing - SP cert\r\n* Logout response validation - IDP cert\r\n\r\nJust browsing, it seems like the pattern is to use the certificate from the system where the request originates. Is that true? If so, we're curious why these certificate choices are made and if we can make this configurable? We are experiencing an issue integrating with ADFS because it seems like ADFS only supports using one certificate pair for validating both the logout request and response."},"comment":{"url":"https://api.github.com/repos/onelogin/python-saml/issues/comments/164952167","html_url":"https://github.com/onelogin/python-saml/issues/102#issuecomment-164952167","issue_url":"https://api.github.com/repos/onelogin/python-saml/issues/102","id":164952167,"user":{"login":"pitbulk","id":600897,"avatar_url":"https://avatars.githubusercontent.com/u/600897?v=3","gravatar_id":"","url":"https://api.github.com/users/pitbulk","html_url":"https://github.com/pitbulk","followers_url":"https://api.github.com/users/pitbulk/followers","following_url":"https://api.github.com/users/pitbulk/following{/other_user}","gists_url":"https://api.github.com/users/pitbulk/gists{/gist_id}","starred_url":"https://api.github.com/users/pitbulk/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pitbulk/subscriptions","organizations_url":"https://api.github.com/users/pitbulk/orgs","repos_url":"https://api.github.com/users/pitbulk/repos","events_url":"https://api.github.com/users/pitbulk/events{/privacy}","received_events_url":"https://api.github.com/users/pitbulk/received_events","type":"User","site_admin":false},"created_at":"2015-12-16T01:14:38Z","updated_at":"2015-12-16T01:14:38Z","body":"```\r\nIs this something from the SAML spec or an assumption that\r\nwas made when the library was developed?\r\n```\r\nSAML spec\r\n\r\n```\r\nOne certificate will be used to validate the logout request from the SP to\r\nthe IDP, and the same cert will be used to sign the logout response going back to the SP\r\n```\r\nNo:\r\n* To validate the logout request from the SP to the IDP, you need the SP certificate.\r\n* To sign the logout response going back to the SP, you need the IdP private key.\r\n\r\nMe and many developers were able to link this toolkit with ADFS, you may misunderstood something.\r\n\r\nhttp://www.xml.com/pub/a/2001/08/08/xmldsig.html \r\n\r\n\r\n\r\n"}}