SAML metadata algorithm support extension questions

[Ian Young]

On 22 Mar 2014, at 19:14, Cantor, Scott <cantor.2 at osu.edu> wrote:

> On 3/21/14, 6:57 PM, "Brent Putman" <putmanb at georgetown.edu> wrote:
>> 
>> 1) The presence of EITHER a SigningMethod OR a DigestMethod at the
>> RoleDescriptor level means you ONLY consider the RoleDescriptor level for
>> *both* elements.
>> 
>> 2) SigningMethod and DigestMethod are considered separately, e.g. the
>> presence of a SigningMethod on the RoleDescriptor does not preclude using
>> the DigestMethod on the EntityDescriptor IF the RoleDescriptor has no
>> DigestMethods.  And vice versa.
> 
> The intent was 2, so that you look for the element you're searching for
> and then go up if you don't find any. They're not meant as a unit.

This makes sense as to what to do, but I can see the ambiguity Brent saw. I take it there isn't an official errata document we could put a clarification in?

	-- Ian



-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 5943 bytes
Desc: not available
Url : http://shibboleth.net/pipermail/dev/attachments/20140324/4c5d4338/attachment.bin