Decryption config

[Brent Putman]

On 5/28/14 8:33 PM, Cantor, Scott wrote:
> For clarification, what's the purpose of wiring the two in a chain? Is
> that just to prevent the KeyInfo hinting from accidentally precluding any
> of the locally configured keys?

Yes, in case the KeyInfo hinting fails, but also to account for the case
where there is no KeyInfo hint at all.  I know your SP probably always
sends an EncryptedKey/KeyInfo with the public key hint, but technically
it's optional. 

>
> The SP has that problem occasionally due to key name conflicts when certs
> don't match, so I was assuming that was what you were thinking.

I don't understand that failure case exactly, you must be doing the
matching in a more stringent way.  But the Java code here won't do
anything with cert data.  As long as the public key in the cert from the
KeyInfo hint matches the public key in the locally configured
credential, it should get resolved. Same with any KeyName(s) in the
hint, matching the key name(s) on the local creds. Modulo some problem
with the LocalKeyInfo- resolver, which I'm going to start testing right
now.  Should have that tested and checked in later this evening.