[java-identity-provider COMMIT] in /trunk/idp-saml-impl/src: main/java/net/shibboleth/idp/saml/impl/profile/saml1/Sig...

[Cantor, Scott]

On 2/6/14, 7:14 PM, "Brent Putman" <putmanb at georgetown.edu> wrote:

>I think this isn't quite right for the signing of assertions, re: getting
>the Assertion signing SignatureSigningParameters from the outbound
>message context.  Doing that means you can't differentiate between the
>cases of signing Assertions and signing Responses,
> which are separate profile config options.  The Assertion one needs to
>live in a different place, presumably somewhere in the same context
>subtree where you store intermediate data used in the profile handling
>process.  (That's what I meant when I said that
> the only real decision regarding use of the security -Parameters is
>deciding where they live for a given profile handling subsystem).

Decryption is an even weirder case in some ways, but for now I left it
hanging off the ProfileRequestContext directly.

I see for signing that indeed we'd have to have separate copies of the
context to represent response from assertion signing, as you say.
Presumably the former on the outbound context, but the latter probably a
direct child of the PRC I guess.

-- Scott