[JIRA] Commented: (CPPXT-91) KeyInfoResolver code returns empty credential object.

[Scott Cantor (JIRA)]

    [ https://issues.shibboleth.net/jira/browse/CPPXT-91?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14462#comment-14462 ] 

Scott Cantor commented on CPPXT-91:
-----------------------------------

Condition rule was also a syntax mistake.

This works fine:
<PolicyRule type="Ignore" xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">saml2:OneTimeUse</PolicyRule>

Normally that's unneeded anyway. Using an empty rule of type="Conditions" defaults to a set of rules that checks time, audience, and ignores the OneTimeUse condition.

I've changed the bug to an improvement request to try and clean up the logging around a KeyDescriptor processed into an empty shell of a credential for verification.

> KeyInfoResolver code returns empty credential object.
> -----------------------------------------------------
>
>                 Key: CPPXT-91
>                 URL: https://issues.shibboleth.net/jira/browse/CPPXT-91
>             Project: XMLTooling - C++
>          Issue Type: Improvement
>          Components: Security
>    Affects Versions: 1.5.0, 1.5.1
>            Reporter: rhoerbe at idp.protectnetwork.org
>            Assignee: Scott Cantor
>            Priority: Minor
>              Labels: TrustEngine
>         Attachments: shibspKeyExtr.zip
>
>
> as described in the mail thread on shib-users from today:
> These are the log messages after the Response was decoded:
> OpenSAML.MessageDecoder.SAML2 [2]: extracting issuer from SAML 2.0 protocol message
> OpenSAML.MessageDecoder.SAML2 [2]: message from (https://apps.egiz.gv.at/moa-id-stork-test/)
> OpenSAML.MessageDecoder.SAML2 [2]: searching metadata for message issuer...
> OpenSAML.SecurityPolicyRule.MessageFlow [2]: evaluating message flow policy (replay checking on, expiration 60)
> XMLTooling.StorageService [2]: inserted record (_eb6...) in context (MessageFlow) with expiration ..
> OpenSAML.SecurityPolicyRule.XMLSigning [2]: validating signature profile
> XMLTooling.KeyInfoResolver.Inline [2]: resolved 0 certificate(s)
> XMLTooling.KeyInfoResolver.Inline [2]: resolved 0 CRL(s)
> XMLTooling.TrustEngine.ExplicitKey [2]: attempting to validate signature with the peer's credentials
> XMLTooling.TrustEngine.ExplicitKey [2]: public key did not validate signature: Credential did not contain a verification key.
> The zip-archive contains the IDP's certificate files, metadata, response message and logfiles.

--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira