Function use in the IdP

[Rod Widdowson]

> Function<XMLObject,
> >Set<String>>.  This is used "for extracting dynamic trusted names from
> >signed metadata elements.".  It strikes me that anyone who wants to
> >override PKIX in JavaScript deserves everything they get, but I
> suppose
> >we might provide such a function?
> 
> It's probably not a crazy idea. Keep in mind that's not PKIX at
> runtime, but in verifying metadata, and I like to be as flexible as
> possible in that area.

I added this as discussed but I just realized that there is a fault in my
reasoning.  We have a plug point, and we have a pluggable function, but we
have not way of doing the plugging because the SignatureValidationFilter is
added via the custom schema.

I could of course just add that configuration to the specific filter, but it
occurs to me that we might be better to do this at a level above, which is
to say to add new MetadataFilterType called SpringFilter

So something like:

	<MetadataProvider [...]>
		<MetadataFilter xsi:type="SpringFilter"
ref="MySpringDefinedBean">
      </MetadatProvider>

The implementation might be slightly ugly (I'd probably need to summon up a
singleton Chain), but it would be a more general solution.

Thoughts?  Or am I over-gilding the lilly?

Rod