Decryption config

[Brent Putman]

On 5/28/14 8:53 PM, Cantor, Scott wrote:
> On 5/28/14, 8:44 PM, "Brent Putman" <putmanb at georgetown.edu> wrote:
>> Yes, in case the KeyInfo hinting fails, but also to account for the case
>> where there is no KeyInfo hint at all.  I know your SP probably always
>> sends an EncryptedKey/KeyInfo with the public key hint, but technically
>> it's optional.
> Yes, in the SP's case though the lack of a hint just means it doesn't
> filter any of the credentials out, but it sounds like that's not true here.

Ok, I see.  What the LocalKeyInfo- resolver does isn't really
filtering.  It uses the the public key and key name hints from the
KeyInfo to construct Criterion instances and then actively lookup creds
from the local CredentialResolver.  So if there's no hints, you'd get
nothing out of it.   It doesn't assume any sort of list, etc of local
creds.  It's just calling into the local CredentialResolver, and in that
API there's no way currently to even say "just give me all the
credentials you have".