Duplicate signing

[Brent Putman]

On 10/29/15 5:51 PM, Cantor, Scott wrote:
> Brent, it looks like the message-signing message handler just signs unconditionally, which is fine,

Yeah, thinking about it, I think design-wise my intent was that you'd
have (potentially) a different set of outbound handlers for each
binding.  But for outbound, the binding is dynamic and we didn't do
anything like that.  I see now that what we actually did is just have
one common outbound handler chain for all SSO flows, i.e. for SAML 2
just one chain (shibboleth.PreEncodeMessageHandler) defined in
sso-abstract-beans.xml.


>  but do I need to just attach a condition to it from the outside to check for the other bindings or is there a more elegant way?

Since it's probably a pretty big change to do the above, having an
activationCondition for it nominally sounds fine.  But of course it's
not an (adapted) Action, it's just a raw MessageHandler inside a chain,
and those don't have activation conditions natively.  Would have to wrap
that individual handler in the Action adapter, I think.

I suppose it might not be wrong to special case this directly inside
that handler, and have say its doPreInvoke check whether the binding
(via BindingDescriptor) supports signing.

>
> IIRC, wasn't the signing in V2 inside the encoders?

I had to double-check.  Yes, it was, and that's how we handled it, in
each concrete binding impl.  The Redirect one just doesn't call the XML
protocol message signMessage(..) method.  The POST SimpleSign one
actually has a boolean (default false) as to whether it should sign the
XML message in addition to the binding signature.

> I don't think we have had this case come up or at least I didn't note it. 

Yeah, totally didn't register with me.  Might have if I'd paid any
attention to the initial flow wiring, but I was off on other things at
that point.


> I think it's already been happening during the V3 logout response code, and it's come up again where I'm issuing LogoutRequests.

Yeah, it's likely not been a practical issue for the IdP up to this
point since POST doesn't have binding signature, Redirect isn't usable
for SSO responses, and nobody really uses POST SimpleSign. Makes sense
that you're now hitting it with a flow that generates responses using
Redirect binding.



-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20151029/2914dc56/attachment.html>