SignAssertions action not needed ?

[Brent Putman]

On 2/5/14 10:47 PM, Cantor, Scott wrote:
>
> There's no existing DecryptionParameters for the action to use, so that's
> why I didn't use it.

Well, I assume you'd do it like I did the security-oriented
MessageHanders:  you just look for the presence of a
SecurityParametersContext and the relevant -Parametesr, and use it if
present.

Actually, I should have said that upfront.  That's IMHO what any
signing/validating/encrypting/decrypting Action or MessageHandler should
do.  Look for that context and use that data.  It was intended to be
that simple.  How that context gets populated, and with what data, is
out of scope for the action/handler doing the crypto operation.   The
only real decision is, for a given subsystem, where does the
SecurityParametersContext live.  If might be that for simplicity it just
lives directly under the ProfileRequestContext, but I don't know what
general standard you guys have been using (maybe using injected lookup
strategies, etc).

Also related: For message signing, the presence/absence of the
SecurityParametersContext data is what determines whether signing
happens, pure and simple.  Whether the context is present or has a
particular -Parameters is (presumably) determined by the various signing
and encryption flags from the profile config (or whatever, e.g  however
we implement 'conditional' - or not).



-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/dev/attachments/20140205/8c977283/attachment.html