SAML key info configuration

[Brent Putman]

On 6/6/13 11:07 AM, ben.green1005 wrote:
>
> However, a colleague from another team has informed us that it is
> possible to hide the X509 certificate from a SAML token and replace
> the X509 certificate information with a "KeyName".
>


I assume you are referring to the KeyInfo within the EncryptedKey? 
That's the only one I see in your example.


> Is it possible to configure the opensaml implementation to make this
> happen? I have worked out how to add the KeyName field to the token,
> but not how to do this and remove the X509 certificate.
>


Yes, it's absolutely possible.  However, the exact answer re: how to to
it depends on how you are constructing the KeyInfo in the first place. 
The literal answer is: you (ideally) need to adjust the properties on
the KeyInfoGenerator that is ultimately passed to the Encrypter in the
KeyEncryptionParameters instance.  You might me constructing the latter
directly, or you might be using the helper methods in SecurityHelper.

There's also the question of how sophisticated you want to get:  just
simply constructing a KeyInfoGenerator constructed and supplying in the
right place, vs. setting a factory up in the global (or possibly
non-global) SecurityConfiguration, and possibly with a logical name
indicating one of possibly many KeyInfo generation strategies.

Another rather unelegant, but workable, way to do it after the fact is
to just do the encryption as you are now, then just modify the
EncryptedKey/KeyInfo afterwards however you like - remove the X509Data,
add a KeyName, etc.  Or just replace it with a whole new one.  For this
more manual approach, the KeyInfoHelper utility class would be of use.

--Brent