SAML metadata algorithm support extension questions

[Cantor, Scott]

On 3/21/14, 6:57 PM, "Brent Putman" <putmanb at georgetown.edu> wrote:
>
>1) The presence of EITHER a SigningMethod OR a DigestMethod at the
>RoleDescriptor level means you ONLY consider the RoleDescriptor level for
>*both* elements.
>
>2) SigningMethod and DigestMethod are considered separately, e.g. the
>presence of a SigningMethod on the RoleDescriptor does not preclude using
>the DigestMethod on the EntityDescriptor IF the RoleDescriptor has no
>DigestMethods.  And vice versa.

The intent was 2, so that you look for the element you're searching for
and then go up if you don't find any. They're not meant as a unit.

>A resolver processing edge case: For both signing and encryption, if
>there are algorithms present in metadata but the local
>whitelist/blacklist policy winds up filtering them all out:  Are we then
>free to choose from the local list of preferred algorithms (which
> basically means falling back to the non-SAML-aware resolver superclass
>logic)?  Or do we just fail to resolve?  Off-hand I'd think we do the
>former and at least resolve something usable, but wanted to get feedback
>first.

I believe the SP falls through to a default derivation of an algorithm to
use.

-- Scott