SignAssertions action not needed ?

[Brent Putman]

On 2/6/14 7:22 PM, Cantor, Scott wrote:
> On 2/6/14, 5:28 PM, "Tom Zeller" <tzeller at dragonacea.biz> wrote:
>> If SecurityParametersContext is present but
>> getSignatureSigningParameters() returns null, that is an error,
>> correct ?
> Based on what was said, that depends. For the signAssertions action, no,
> it means signing them wasn't enabled, so it's a "skip" indicator.

Ok, yes, my answer was assuming literally what the signing Action might
do, not what the overall behavior in other components is.

For example, if signAssertions=true but (somehow) no
SignatureSigningParameters and signing credential is available, then
that's an error - although in my envisioned model that would happen in
the Action that evals that flag and then attempts to resolve and
populate the params, not in the signing Action.  Same for encryption.
encryptionAssertions=true + no encryption credential resolved from
metadata = error.

> For certain message encoders, there will be exceptions where signing is
> mandatory and it would be an error. Principally the SAML 1 POST encoder.

Hmmm. SAML 1 POST, that's not ringing a bell...why is that mandatory? 
Does the spec just make it required?  I'd have to look at what we did in
v2 also, but I'm not 100% sure we implement that... 

And in v3, at least for SAML protocol message signing with enveloped XML
signature, the signing is done in MessageHandlers, so the encoder would
not do this.  A MessageEncoder would only sign using a binding-specific
type of signature (e.g. HTTP Redirect DEFLATE, POST SimpleSign).

If we needed to implement some sort of mandatory signing rule in v3 for
e.g. SAML 1 POST, it would either have to be done in a MessageHandler
that implemented that rule, or possibly by having the encoder just check
for signature and throw if not there.

> I don't recall what V2 does if you set signing to "never" for both
> assertions and responses. If that doesn't fail, then we're already in that
> mode I guess.

I'd have to go back and check but I don't recall us failing in that
case.  I think it does what you tell it and if you shoot yourself,
that's your right. :-)  But not 100% sure.

(Unfortunately I can't check any of this until I get home b/c my Shib
Eclipse workspace on my work computer is corrupted at the moment).
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/dev/attachments/20140206/24cb62ab/attachment.html