Defaults for encryption and signing predicates in SAML profiles

[Cantor, Scott]

On 4/29/14, 5:01 AM, "Rod Widdowson" <rdw at steadingsoftware.com> wrote:

>While I was adding the parse for encryptAttributes to the SAML2 profiles I
>realized that in porting the parsers over from V2 I was bring with them
>the
>"defaulted in the setter" paradigm for the signing and encryption
>predicates.  We are hoping to avoid this non-obvious behaviour and so by
>way
>of an experiment I turned this off.

I don't think we really can, because of compatibility, can we?

>Several defaulting tests failed indicating that the V3 defaults are not V2
>defaults.  Some of this is to do with the funky "conditional" type that
>the
>V2 config allows.

Well, that setting itself will be deprecated in favor of a predicate, and
my intention was we'd treat the old setting as a trigger to install the
legacy predicate. Alternatively, we could overload the setting itself and,
now that it's a string type, we could use it to either carry the old
values or a bean-ref.

>I'm vaguely disquieted by this, but not enough (yet) to do a full analysis
>of where the differences are.  If however others share my disquiet I'll do
>an analysis of the two systems and circulate a table of where they differ.

We should definitely look into it.

-- Scott