SignAssertions action not needed ?

[Brent Putman]

On 2/4/14 12:16 PM, Cantor, Scott wrote:
> On 2/4/14, 12:13 PM, "Tom Zeller" <tzeller at dragonacea.biz> wrote:
>
>> SignAssertions is not needed as a flow action because assertion
>> signing is being done in the outbound message handler, correct ?
> No, the handler will only do message signing. The layers will be distinct.

Yes, agreed.

>
> Note, I couldn't implement that action today, so there's no way you could.
> Brent needs to help on that.


I think it's actually pretty easy, all the components are there.  It
would look a whole lot like the message handler that signs the outbound
Response, except obviously just operating on the Assertion:

http://svn.shibboleth.net/view/java-opensaml/trunk/opensaml-saml-impl/src/main/java/org/opensaml/saml/common/binding/security/SAMLOutboundProtocolMessageSigningHandler.java?revision=3549&view=markup


There's a couple of utility methods there which are somewhat specific to
the protocol message handling case, operating on MessageContext, but the
idea would be the same:
1) Check for and get the  SignatureSigningParameters instance to be used
(for the profile flow it's TBD where that would live) and
2) if present, get the Assertion and sign it.  Signing is fairly
boilerplate.  See any of our signing code, such as in
SAMLMessageSecuritySupport.signMessage(messageContext).

In fact, thinking about it, I don't think we have currently have a
general utility method anywhere that takes a SignableSAMLObject (or
maybe SignableXMLObject) and a SignatureSigningParameters, and signs,
but we probably should.  It's like 10 lines of code.  I'll do one
tomorrow unless someone beats me to it.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/dev/attachments/20140204/b6c0c25d/attachment.html