Security configs

[Cantor, Scott]

I'm not done thinking, but after a bunch of permutations, I'm coming to 
the conclusion that creating a bunch of default piecemeal beans or 
exposing them in user files ultimately doesn't seem to help much vs. just 
using bean inheritance.

Things get fairly complex if I try and factor out pieces of the security 
config into the root context because I still have to inherit from those 
beans down inside rp-system because the credential beans are defined in 
that context.

For example, if I created some kind of "base" bean set for SHA-1 and SHA-2 
signing configuration, I'd have to inherit from them and create two more 
"default" beans that fill in the signingCredentials property. It all gets 
unwieldy.

Instead, you can do something like this if you wanted to override the 
signing key:

<bean id="MyConfig" parent="shibboleth.DefaultSecurityConfiguration">
  <property name="signatureSigningConfiguration">
    <bean parent="shibboleth.SigningConfiguration.SHA256" 
signingCredentials-ref="MyCredential" />
   </property>
</bean>

All of the other content of shibboleth.DefaultSecurityConfiguration get 
copied in for you.

I'm not saying the above is great, but I'm finding it hard to improve by 
breaking apart the beans into smaller bits.

-- Scott