Parsing Trust Engines
Rod Widdowson
rdw at steadingsoftware.com
Thu Jun 19 09:09:16 EDT 2014
I am back filling a bit and adding the missing TrustEngine missing parsers
for the legacy relying-party and metadata files.
The only use left for a V2 <TrustEngine> is as an input to the
SignatureValidation filter, all others serve no function since they are
referenced in parts of relying-party which have been superseded and are not
even parsed.
I had initially thought that this meant that we had to parse all trust
engine types except the 4 Metadata based ones
MetadataPKIXSignature,
MetadataExplicitKeySignature,
MetadataPKIXX509Credential and
MetadataExplicitKey
But on closer investigation I believe that there are several others which
can never have been used and I wanted to check my logic.
The SignatureValidation filter requires that a SignatureTrustEngine be
injected. This would seem to rule it being configured with any of the
Credential Trust Engines.
Hence, if I understand correctly, only the following types can be injected
into a SignatureValidation filter
SignatureChaining
StaticPKIXSignature
StaticExplicitKeySignature
and we only need to parse them.
For the record the remaining types are:
StaticPKIXX509Credential
StaticExplicitKey
Chaining
More information about the dev
mailing list