Custom Santuario Content Resolver

[Chad La Joie]

This is mostly for Brent and Scott, but I thought some others (Paul
H.) might be interested as well.

One of the upcoming changes[1] in Santuario-J 1.5 is how same-document
Elements are resolved by ID.  I think we should move to using a custom
org.apache.xml.security.utils.resolver.ResourceResolver implementation
that has baked in knowledge of the constraints imposed by the SAML
signature profile.

Scott can correct me if I'm wrong, but I think those profiles let us
perform the following additional checks (above just a straight ID
resolution):
- that there is only a single, in-document, content reference
- that the dereference object is always the element that contains the
signature being checked

Obviously we'd need to ensure that this specialized resolver is only
used when perform the validation of signatures that should adhere tot
he SAML signature profile.  The benefit though is the mitigation of
nasty wrapping attacks.

Also, I haven't dug in to the encryption profile but it too probably
provides us with some constraints that we can use to tighten things
down.

Thoughts?

[1] http://coheigea.blogspot.com/2012/01/apache-santuario-xml-security-for-java.html
-- 
Chad La Joie
www.itumi.biz
trusted identities, delivered