<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<br>
<div class="moz-cite-prefix">On 2/4/14 12:16 PM, Cantor, Scott
wrote:<br>
</div>
<blockquote cite="mid:CF168A8B.48EE6%25cantor.2@osu.edu" type="cite">
<pre wrap="">On 2/4/14, 12:13 PM, "Tom Zeller" <a class="moz-txt-link-rfc2396E" href="mailto:tzeller@dragonacea.biz"><tzeller@dragonacea.biz></a> wrote:
</pre>
<blockquote type="cite">
<pre wrap="">SignAssertions is not needed as a flow action because assertion
signing is being done in the outbound message handler, correct ?
</pre>
</blockquote>
<pre wrap="">
No, the handler will only do message signing. The layers will be distinct.</pre>
</blockquote>
<br>
Yes, agreed.<br>
<br>
<blockquote cite="mid:CF168A8B.48EE6%25cantor.2@osu.edu" type="cite">
<pre wrap="">
Note, I couldn't implement that action today, so there's no way you could.
Brent needs to help on that.
</pre>
</blockquote>
<br>
<br>
I think it's actually pretty easy, all the components are there. It
would look a whole lot like the message handler that signs the
outbound Response, except obviously just operating on the Assertion:<br>
<br>
<a class="moz-txt-link-freetext" href="http://svn.shibboleth.net/view/java-opensaml/trunk/opensaml-saml-impl/src/main/java/org/opensaml/saml/common/binding/security/SAMLOutboundProtocolMessageSigningHandler.java?revision=3549&view=markup">http://svn.shibboleth.net/view/java-opensaml/trunk/opensaml-saml-impl/src/main/java/org/opensaml/saml/common/binding/security/SAMLOutboundProtocolMessageSigningHandler.java?revision=3549&view=markup</a><br>
<br>
<br>
There's a couple of utility methods there which are somewhat
specific to the protocol message handling case, operating on
MessageContext, but the idea would be the same:<br>
1) Check for and get the
<meta http-equiv="content-type" content="text/html;
charset=ISO-8859-1">
SignatureSigningParameters instance to be used (for the profile flow
it's TBD where that would live) and<br>
2) if present, get the Assertion and sign it. Signing is fairly
boilerplate. See any of our signing code, such as in
<meta http-equiv="content-type" content="text/html;
charset=ISO-8859-1">
SAMLMessageSecuritySupport.signMessage(messageContext).<br>
<br>
In fact, thinking about it, I don't think we have currently have a
general utility method anywhere that takes a SignableSAMLObject (or
maybe SignableXMLObject) and a SignatureSigningParameters, and
signs, but we probably should. It's like 10 lines of code. I'll do
one tomorrow unless someone beats me to it.<br>
<br>
</body>
</html>