Custom Santuario Content Resolver

[Chad La Joie]

On Tue, Jan 17, 2012 at 12:37, Cantor, Scott <cantor.2 at osu.edu> wrote:
> On 1/17/12 10:30 AM, "Chad La Joie" <lajoie at itumi.biz> wrote:
>>
>>One of the upcoming changes[1] in Santuario-J 1.5 is how same-document
>>Elements are resolved by ID.  I think we should move to using a custom
>>org.apache.xml.security.utils.resolver.ResourceResolver implementation
>>that has baked in knowledge of the constraints imposed by the SAML
>>signature profile.
>
> It's definitely been the case that people using OpenSAML are failing to
> impose the SignatureProfileValidator step, so our fix to the wrapping
> issue has helped us, but not so much others.
>
> If we can bake this in in such a way that our code automatically does the
> right thing if our basic signature checking APIs are used, that seems like
> an improvement.

Yes, I'm pretty sure we can using the xmlsec APIs and I know we can
using the JSR APIs that we're moving towards.

-- 
Chad La Joie
www.itumi.biz
trusted identities, delivered