Security parsing - signing and defaults

[Cantor, Scott]

On 4/22/14, 9:16 AM, "Rod Widdowson" <rdw at steadingsoftware.com> wrote:

>These are both in some way to do summoning up the
>net.shibboleth.idp.profile.config.SecurityConfiguration which needs to be
>injected into each profile configuration.

And all the ancillary parameters.

>Dealing with the third (securityPolicyRef on the ProfileConfiguration)
>first:  We can either warn if we encounter this or we can plant a
>reference
>to an (externally defined) instance of
>net.shibboleth.idp.profile.config.SecurityConfiguration.

I don't think it fits well with SecurityConfiguration, actually, it's
really the thing we're not doing with an inboundFlowId.

If you look at the schema, this is one of those bad design spots where
he's defaulting in the value to point to something that's actually in the
file. What we can do is deperecate it, and take out the default so that
it's optional and if set, we warn and ignore. I think that's the best
choice.


>So my question is what should I do about the signing credential
>references?
>I have been presuming that I need to summon up a
>net.shibboleth.idp.profile.config.SecurityConfiguration and inject a
>SignatureSigningConfiguration into it but:
>
>1) (for Scott) how to I ensure that it collects all the other "sensible
>defaults"

I think what we need to do is create a file and bean that defines the
default SecurityConfiguration and all the various parameters. By default
every RP definition would summon up that prototype bean. If (in the common
case today) the signing credential is set, I suggest we use that to
override the Credential in the parameters, and warn that it's deprecated.

>2) (for Brent) how do I summon up  a SignatureSigningConfiguration given a
>Credential.   BasicSignatureSigningConfiguration might do what I need,
>but again the
>question how to get sensible defaults?

I think we'll have to lay them out with Spring by hand, unless I'm missing
something. Or we just use OpenSAML's global default, but we kind of talked
about not doing that.

-- Scott