Duplicate signing

[Brent Putman]

On 10/31/15 6:12 PM, Cantor, Scott wrote:
> I realized there's really only one correct approach, we should just use Predicate<MessageContext> whereever that's appropriate, and then if we need a Predicate<ProfileRequestContext> we should build that adapter (and have it specify INBOUND or OUTBOUND).

I agree, that's true in general.
 

>  Otherwise we'd have to build the inbound/outbound flag into every one of these predicates anyway.

For this specific predicate and use case, I assumed we'd only ever care
about it on the outbound side, since that's where we do signing, so we
*could* code a Predicate<PRC> that way.  But having a more general
Predicate<MessageContext> is also fine.

Given the latter, I guess we could in theory now make inbound (slightly)
more efficient by not even running the Redirect and POST SimpleSign
signature validating handlers if the binding doesn't support signing.

Or, even better, since those actually are binding-specific, have them
only run for those individual bindings rather than for everything.  They
of course sanity check whether there's a raw signature present, but we
could now in theory short-circuit that.  We'd either need a binding URI
predicate, or perhaps a more general expression language one.  Not
urgent, maybe I'll put in an issue for a future release.  More an issue
of testing than coding...

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20151102/2a443003/attachment-0001.html>