Function use in the IdP

[Brent Putman]

On 11/20/14 12:27 PM, Brent Putman wrote:
>
> Ah, yes, forgot about the schema.   The filter defaults in our Basic-
> impl of that function, 

Actually it wasn't doing that.  I think I consciously held off on that. 
But I just added it, can't think of a reason not to.


>  There may be
> some other things too that we need to add on signature filter.  I
> vaguely recall some other changes there that may not have been reflected
> in the schema.  I'll look later today.


The dynamic names strategy was the only addition to the filter class
itself, versus V2.  But even in V2 in the schema and parsers we never
accounted for customizing the default static CriteriaSet and the
Signature prevalidator.  The former never had a real-world use case; the
latter was defaulted to our basic SAML Signature profile one (the only
one we have).

The CriteriaSet one is now actually kind of important, as that is the
only way (currently) to get a signature algorithm whitelist/blacklist
into the metadata signature validation process.  So we probably need to
at least account for that with a bean ref, or else explicitly add
something related to algorithm white-/blacklisting to the schema which
results one way or another in a SignatureValidationParametersCriterion
being added in buildCriteriaSet(...).  I'll open an issue on that so as
not to forget.

The other 2 cases (trusted names strategy, signature prevalidator) could
also be easily addressed with schema slots for bean refs, although these
seem less critical.