Exception when creating the signature using OpenSAML lib

[Brent Putman]

On 10/31/12 8:40 PM, Yaowen Tu wrote:
> Another related question is: how to retrieve the credential under
> <Signature>?

You use a KeyInfoCredentialResolver to resolve Credentials from a
ds:KeyInfo element.  I don't know if that's documented in the wiki, but
I'm sure there are some unit tests you can use as an example.

In general, though, be careful that the Signature/KeyInfo is only a
hint, you can not trust that key.  You have to validate that the key is
trusted, one way or another (either from a set of trusted keys or via
X.509 PKIX, etc).

We also have a higher-level of abstraction called TrustEngine, which
wraps up the signature verification and trust processing in a single
component.