Security parsing - signing and defaults

[Brent Putman]

Just a quick note to say that I'm really swamped with a GU project
today.  I'll look at this and the other trust engine thread in detail
tomorrow, which is one of my official "Shib work" days.

I'm also not really clear on the when/where/how/why of the use here of
the legacy v2 stuff vs the new stuff.


On 4/22/14 9:16 AM, Rod Widdowson wrote:
> Mostly for Scott and Brent...
>
> I am left with a couple dangling references which I need to tidy up for the
> relying party configuration.
>
> These are both in some way to do summoning up the
> net.shibboleth.idp.profile.config.SecurityConfiguration which needs to be
> injected into each profile configuration.
>
> The Schema provides three mechanisms to control some of the stuff which is
> in here.  The first two (defaultSigningCredentialRef on the RelyingParty and
> signingCredentialRef on the ProfileConfiguration) are references to a
> <Credential>, the third (securityPolicyRef on the ProfileConfiguration) is a
> reference to the <security:SecurityPolicy/> statements at the bottom of the
> relying party file which, if I understood the conversation last Friday are
> not going to be part of V3 since they are replaced by SWF configuration.
>
> My issue is to make sense of these three, whilst at the same time respecting
> the defaults which will be (I assume) configured external to
> relying-party.xml.
>
> Dealing with the third (securityPolicyRef on the ProfileConfiguration)
> first:  We can either warn if we encounter this or we can plant a reference
> to an (externally defined) instance of
> net.shibboleth.idp.profile.config.SecurityConfiguration.  
>
> So my question is what should I do about the signing credential references?
> I have been presuming that I need to summon up a
> net.shibboleth.idp.profile.config.SecurityConfiguration and inject a
> SignatureSigningConfiguration into it but:
>
> 1) (for Scott) how to I ensure that it collects all the other "sensible
> defaults"
> 2) (for Brent) how do I summon up  a SignatureSigningConfiguration given a
> Credential.  
>     BasicSignatureSigningConfiguration might do what I need, but again the
> question how to get sensible defaults?
>     The factory method
> DefaultSecurityConfigurationBootstrap#buildDefaultSignatureSigningConfigurat
> ion() also looks useful but the result of this does not allow me to set the
> Credentials to be used.
>
> Thanks
>
> Rod
>
>
> --
> To unsubscribe from this list send an email to dev-unsubscribe at shibboleth.net