[java-identity-provider COMMIT] in /trunk/idp-saml-impl/src: main/java/net/shibboleth/idp/saml/impl/profile/saml1/Sig...

[Brent Putman]

Tom,
I think this isn't quite right for the signing of assertions, re:
getting the Assertion signing SignatureSigningParameters from the
outbound message context.  Doing that means you can't differentiate
between the cases of signing Assertions and signing Responses, which are
separate profile config options.  The Assertion one needs to live in a
different place, presumably somewhere in the same context subtree where
you store intermediate data used in the profile handling process. 
(That's what I meant when I said that the only real decision regarding
use of the security -Parameters is deciding where they live for a given
profile handling subsystem).


On 2/6/14 6:55 PM, noreply at shibboleth.net wrote:
>
> Modified: trunk/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/impl/profile/saml1/SignAssertions.java
>
> +        final MessageContext<Response> outboundMsgCtx = profileRequestContext.getOutboundMessageContext();
> +        if (outboundMsgCtx == null) {
> +            log.debug("{} No outbound message context available", getId());
> +            ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_MSG_CTX);
> +            return false;
> +        }
> +
> +        final SecurityParametersContext secParamCtx = outboundMsgCtx.getSubcontext(SecurityParametersContext.class);
> +        if (secParamCtx == null) {
> +            log.debug("{} Will not sign assertions because no security parameters context is available", getId());
> +            return false;
> +        }
> +
> +        signatureSigningParameters = secParamCtx.getSignatureSigningParameters();
> +        if (signatureSigningParameters == null) {
> +            log.debug("{} Will not sign assertions because no signature signing parameters available", getId());
> +            return false;
> +        }
> +
>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/dev/attachments/20140206/83571f70/attachment.html