IdP credentials for delegation Assertion signature validation

[Cantor, Scott]

On 8/20/15, 10:32 PM, "dev on behalf of Brent Putman" <dev-bounces at shibboleth.net on behalf of putmanb at georgetown.edu> wrote:

>I wasn't referring to doing some complex config for delegation.  Just that there can be many SecurityConfiguration instances: the default one and then ones at other levels.  That's already true today. Rod mentioned using just the default one, and that won't work b/c it obviously doesn't necessarily include them all.

But that isn't necessarily the credentials themselves, just references to them in most cases.

>The intention is that the credentials would be declared in one place, even if they're applied/used in different situations.

If that's the case, you don't need a service. Just inject the one collection of public keys into your profile config. No special work needed.

>Totally agreed, they should all be defined in one place (conf/credentials.xml).  Else insanity ensues.

Right, so why do we need a new service?

>I was wondering whether we should do something similar for the encryption ones (the single list), just for symmetry.  That seems easy.  If you're suggesting moving all credential usage to be via the CredentialService, that seems more than what I needed.

I guess I'm not following the suggestion. We'd have to, AFAICT.

>Without that, wouldn't we need to basically inject Credential proxies into current components?  Where the proxy delegates to the CredentialService.

Yes, and I'm basically trying to avoid all that with a simplifying assumption that we can just inject one collection of keys into the profile config bean, in the existing service/context, and you just read from that in your evaluation of the signature.

-- Scott