Decryption config

[Cantor, Scott]

On 5/28/14, 8:44 PM, "Brent Putman" <putmanb at georgetown.edu> wrote:
>
>Yes, in case the KeyInfo hinting fails, but also to account for the case
>where there is no KeyInfo hint at all.  I know your SP probably always
>sends an EncryptedKey/KeyInfo with the public key hint, but technically
>it's optional.

Yes, in the SP's case though the lack of a hint just means it doesn't
filter any of the credentials out, but it sounds like that's not true here.

>I don't understand that failure case exactly, you must be doing the
>matching in a more stringent way.  But the Java code here won't do
>anything with cert data.

The SP optionally (but by default) attaches key name information locally
based on the content of a cert that's loaded, so that's where the matching
can break.

-- Scott