Шибболет SP - ключ подписи и ключ шифрования

У меня есть Шибболет SP, установленный на Сервере 2 012 R2. Я пытался отправить метаданные, которые будут импортированы в IDP, и был сказан, что, не имея ключа подписи или ключа шифрования, они не смогут отправить SP любые утверждения.

Из того, что я нашел на этом, Шибболет, SP имеет ключ к использованию, включенному в стандартную установку. Я полагаю, что это - sp-cert.pem и sp-key.pem, включенный в папку C:\opt\shibboleth-sp\etc\shibboleth.

Я не уверен, как сослаться на него в файле Shibboleth2.xml также. Вот мой shibboleth2.xml с прямо сейчас:

<SPConfig xmlns="urn:mace:shibboleth:2.0:native:sp:config"
xmlns:conf="urn:mace:shibboleth:2.0:native:sp:config"
xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"    
xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
logger="syslog.logger" clockSkew="180">

<!-- The OutOfProcess section contains properties affecting the shibd daemon. -->
<OutOfProcess logger="shibd.logger">

</OutOfProcess>

<!-- The InProcess section conrains settings affecting web server modules/filters. -->
<InProcess logger="native.logger">
    <ISAPI normalizeRequest="true">

        <Site id="1" name="sp-example.com"/>
    </ISAPI>
</InProcess>


<!-- This set of components stores sessions and other persistent data in daemon memory. -->
<StorageService type="Memory" id="mem" cleanupInterval="900"/>
<SessionCache type="StorageService" StorageService="mem" cacheTimeout="3600" inprocTimeout="900" cleanupInterval="900"/>
<ReplayCache StorageService="mem"/>
<ArtifactMap artifactTTL="180"/>



<!-- To customize behavior, map hostnames and path components to applicationId and other settings. -->
<RequestMapper type="Native">
    <RequestMap applicationId="default">
        <Host name="sp-example.com" authType="shibboleth" requireSession="true"/>

    </RequestMap>
</RequestMapper>


<ApplicationDefaults id="default" policyId="default"
    entityID="urn:mace:university.edu:shibboleth:test:sp:university:administrative:cscn:sp-example.com"
    homeURL="https://sp-example.com"
    REMOTE_USER="eppn persistent-id targeted-id"
    signing="false" encryption="false"
    >


    <Sessions lifetime="28800" timeout="3600" checkAddress="false"
        handlerURL="/Shibboleth.sso" handlerSSL="true"
        exportLocation="http://sp-example.com/Shibboleth.sso/GetAssertion" exportACL="165.91.23.32"
        idpHistory="false" idpHistoryDays="7" cookieProps="https" >


        <SessionInitiator type="Chaining" Location="/Login" isDefault="true" id="Intranet"
                relayState="cookie" entityID="urn:mace:university.edu:shibboleth:test:idp:university:administrative:cscn:idp-test.university.edu">
            <SessionInitiator type="SAML2" defaultACSIndex="1" acsByIndex="false" template="bindingTemplate.html"/>
            <SessionInitiator type="Shib1" defaultACSIndex="5"/>
        </SessionInitiator>

        <md:AssertionConsumerService Location="/SAML2/POST" index="1"
            Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"/>
        <md:AssertionConsumerService Location="/SAML2/POST-SimpleSign" index="2"
            Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign"/>
        <md:AssertionConsumerService Location="/SAML2/Artifact" index="3"
            Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact"/>
        <md:AssertionConsumerService Location="/SAML2/ECP" index="4"
            Binding="urn:oasis:names:tc:SAML:2.0:bindings:PAOS"/>
        <md:AssertionConsumerService Location="/SAML/POST" index="5"
            Binding="urn:oasis:names:tc:SAML:1.0:profiles:browser-post"/>
        <md:AssertionConsumerService Location="/SAML/Artifact" index="6"
            Binding="urn:oasis:names:tc:SAML:1.0:profiles:artifact-01"/>

        <!-- LogoutInitiators enable SP-initiated local or global/single logout of sessions. -->
        <LogoutInitiator type="Chaining" Location="/Logout" relayState="cookie">
            <LogoutInitiator type="SAML2" template="bindingTemplate.html"/>
            <LogoutInitiator type="Local"/>
        </LogoutInitiator>

        <!-- md:SingleLogoutService locations handle single logout (SLO) protocol messages. -->
        <md:SingleLogoutService Location="/SLO/SOAP"
            Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP"/>
        <md:SingleLogoutService Location="/SLO/Redirect" conf:template="bindingTemplate.html"
            Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"/>
        <md:SingleLogoutService Location="/SLO/POST" conf:template="bindingTemplate.html"
            Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"/>
        <md:SingleLogoutService Location="/SLO/Artifact" conf:template="bindingTemplate.html"
            Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact"/>

        <!-- md:ManageNameIDService locations handle NameID management (NIM) protocol messages. -->
        <md:ManageNameIDService Location="/NIM/SOAP"
            Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP"/>
        <md:ManageNameIDService Location="/NIM/Redirect" conf:template="bindingTemplate.html"
            Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"/>
        <md:ManageNameIDService Location="/NIM/POST" conf:template="bindingTemplate.html"
            Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"/>
        <md:ManageNameIDService Location="/NIM/Artifact" conf:template="bindingTemplate.html"
            Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact"/>


        <md:ArtifactResolutionService Location="/Artifact/SOAP" index="1"
            Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP"/>

        <!-- Extension service that generates "approximate" metadata based on SP configuration. -->
        <Handler type="MetadataGenerator" Location="/Metadata" signing="false"/>

        <!-- Status reporting service. -->
        <Handler type="Status" Location="/Status" acl="127.0.0.1"/>

        <!-- Session diagnostic service. -->
        <Handler type="Session" Location="/Session" showAttributeValues="false"/>

    </Sessions>


    <Errors session="sessionError.html"
        metadata="metadataError.html"
        access="accessError.html"
        ssl="sslError.html"
        localLogout="localLogout.html"
        globalLogout="globalLogout.html"
        supportContact="root@localhost"
        logoLocation="/shibboleth-sp/logo.jpg"
        styleSheet="/shibboleth-sp/main.css"/>


    <!-- Chains together all your metadata sources. -->
    <MetadataProvider type="Chaining">
        <!-- Example of remotely supplied batch of signed metadata. -->
        <MetadataProvider type="XML" uri="https://idp-test.university.edu/universityfed-test-metadata-signed.xml"
             backingFilePath="C:\opt\shibboleth-sp\etc\shibboleth\universityfed-test-metadata-signed.xml" reloadInterval="7200">
        </MetadataProvider>
    </MetadataProvider>

    <!-- Chain the two built-in trust engines together. -->
    <TrustEngine type="Chaining">
        <TrustEngine type="ExplicitKey"/>
        <TrustEngine type="PKIX"/>
    </TrustEngine>

    <!-- Map to extract attributes from SAML assertions. -->
    <AttributeExtractor type="XML" path="attribute-map.xml"/>

    <!-- Use a SAML query if no attributes are supplied during SSO. -->
    <AttributeResolver type="Query"/>

    <!-- Default filtering policy for recognized attributes, lets other data pass. -->
    <AttributeFilter type="XML" path="attribute-policy.xml"/>


</ApplicationDefaults>

<!-- Each policy defines a set of rules to use to secure messages. -->
<SecurityPolicies>
    <!-- The predefined policy enforces replay/freshness and permits signing and client TLS. -->
    <Policy id="default" validate="false">
        <Rule type="MessageFlow" checkReplay="true" expires="60"/>
        <Rule type="ClientCertAuth" errorFatal="true"/>
        <Rule type="XMLSigning" errorFatal="true"/>
        <Rule type="SimpleSigning" errorFatal="true"/>
    </Policy>
</SecurityPolicies>

Согласно электронному письму я получил, я должен включать <md:KeyDescriptor use="encryption"> и <md:KeyDescriptor use="signing">

Из того, что я нашел онлайн, это должно быть что-то подобное:

<md:SPSSODescriptor>
<md:KeyDescriptor>
    <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
        <ds:X509Data>
            <ds:X509Certificate>
                hash found in sp-cert.pem file
            </ds:X509Certificate>
        </ds:X509Data>
    </ds:KeyInfo>
</md:KeyDescriptor>

Я не знаю, куда я должен помещать это в файл Shibboleth.xml.

Кто-либо может помочь получить меня на правильном пути? Я был через достойную сумму документации и руководств от различных учреждений, но не нашел направления.