Parsing Trust Engines

Rod Widdowson rdw at steadingsoftware.com
Thu Jun 19 09:09:16 EDT 2014


I am back filling a bit and adding the missing TrustEngine missing parsers
for the legacy relying-party and metadata files.

The only use left for a V2 <TrustEngine> is as an input to the
SignatureValidation filter, all others serve no function since they are
referenced in parts of relying-party which have been superseded and are not
even parsed.

I had initially thought that this meant that we had to parse all trust
engine types except the 4 Metadata based ones

	MetadataPKIXSignature, 
	MetadataExplicitKeySignature, 
	MetadataPKIXX509Credential and 
	MetadataExplicitKey 

But on closer investigation I believe that there are several others which
can never have been used and I wanted to check my logic.

The SignatureValidation filter requires that a SignatureTrustEngine be
injected.  This would seem to rule it being configured with any of the
Credential Trust Engines.

Hence, if I understand correctly, only the following types can be injected
into a SignatureValidation filter 

	SignatureChaining
	StaticPKIXSignature
	StaticExplicitKeySignature

and we only need to parse them.

For the record the remaining types are:

	StaticPKIXX509Credential
	StaticExplicitKey
	Chaining






More information about the dev mailing list