Issues in using OpenSAML 4.x in FIPS compliant applications

[Cantor, Scott]

> Based on the discussion there, there are just a couple of classes that
> are eagerly loaded that pull in these dependencies, and it might just
> need a simple parameter created to avoid doing that in FIPs compliant
> mode.

The investigation Paul just did is what we would have done at some point provided somebody filed a bug about it. I certainly wasn't going to do that work to answer the basic question.

Whether that leads to a simple fix is a different issue, but that's up to Brent. I will say it seems pretty disadvantageous to me for the package names to be different between them. Unless those classes are programmatically loaded, not sure how that's going to fly. I assume they aren't now, or this wouldn't be a compile time dependency problem.

-- Scott