SignAssertions action not needed ?

[Brent Putman]

On 2/6/14 5:28 PM, Tom Zeller wrote:
>
> If SecurityParametersContext is present but
> getSignatureSigningParameters() returns null, that is an error,
> correct ?

No, it just means don't sign.

In the IdP, given that we wouldn't be doing validation, encryption or
decryption on an outbound message flow (those being the other 3 property
slots on that context), it would be "odd" to have added a
SecurityParametersContext without a SignatureSigningParameters any data
(the other 3 would presumably be empty also), but not really an error.

But this could certainly be the case in other contexts, e.g. the
outbound request flow of an SP that isn't signing this particular
message but is encrypting the message Subject NameID (if it were done at
the message handling level).

To anticipate your next question, I'd think that the IdP actions that
for example sign and/or encrypt the Assertion would be coded similarly. 
Presence of the data signals sign and/or encrypt, otherwise don't.  The
stuff earlier in the flow that handles deciding whether to even do (i.e.
the profile config flags) and resolving the params is the place where
errors in resolution should be handled, IMHO.  It keeps the encrypting
and signing code simpler by only looking at the config flags once (that
is, earlier in the flow).

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/dev/attachments/20140206/5db60054/attachment-0001.html