SignAssertions action not needed ?

[Cantor, Scott]

On 2/5/14, 10:07 PM, "Tom Zeller" <tzeller at dragonacea.biz> wrote:

>>  to support use of a runtime dynamically-derived trust engine per
>>invocation (via SignatureValidationParams)
>
>I am pretty clueless, here, but ... under what kind of conditions would
>the trust engine be determined dynamically ? For algorithms requested or
>preferred per profile ?

We never really have. The SP doesn't, unless you count that you can have a
TrustEngine associated with a set of web resources separately from other
resources.

I could invent a scenario I suppose where you want to blacklist SHA-1
except for some set of legacy partners, and limit the exposure. But I'm
not sure I buy that use case really, and at most that would just argue for
the blacklist being per-call and not necessarily having to vary the
TrustEngine.

I think our model is more that if you want the TrustEngine to vary
behavior per-RP, you build that intelligence into the engine, not by
deriving a static engine per-RP.

-- Scott