<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<br>
<div class="moz-cite-prefix">On 2/6/14 7:22 PM, Cantor, Scott wrote:<br>
</div>
<blockquote cite="mid:CF1990B5.86CF%25cantor.2@osu.edu" type="cite">
<pre wrap="">On 2/6/14, 5:28 PM, "Tom Zeller" <a class="moz-txt-link-rfc2396E" href="mailto:tzeller@dragonacea.biz"><tzeller@dragonacea.biz></a> wrote:
</pre>
<blockquote type="cite">
<pre wrap="">
If SecurityParametersContext is present but
getSignatureSigningParameters() returns null, that is an error,
correct ?
</pre>
</blockquote>
<pre wrap="">
Based on what was said, that depends. For the signAssertions action, no,
it means signing them wasn't enabled, so it's a "skip" indicator.
</pre>
</blockquote>
<br>
Ok, yes, my answer was assuming literally what the signing Action
might do, not what the overall behavior in other components is.<br>
<br>
For example, if signAssertions=true but (somehow) no
SignatureSigningParameters and signing credential is available, then
that's an error - although in my envisioned model that would happen
in the Action that evals that flag and then attempts to resolve and
populate the params, not in the signing Action. Same for
encryption. encryptionAssertions=true + no encryption credential
resolved from metadata = error.<br>
<br>
<blockquote cite="mid:CF1990B5.86CF%25cantor.2@osu.edu" type="cite">
<pre wrap="">
For certain message encoders, there will be exceptions where signing is
mandatory and it would be an error. Principally the SAML 1 POST encoder.</pre>
</blockquote>
<br>
Hmmm. SAML 1 POST, that's not ringing a bell...why is that
mandatory? Does the spec just make it required? I'd have to look
at what we did in v2 also, but I'm not 100% sure we implement
that... <br>
<br>
And in v3, at least for SAML protocol message signing with enveloped
XML signature, the signing is done in MessageHandlers, so the
encoder would not do this. A MessageEncoder would only sign using a
binding-specific type of signature (e.g. HTTP Redirect DEFLATE, POST
SimpleSign).<br>
<br>
If we needed to implement some sort of mandatory signing rule in v3
for e.g. SAML 1 POST, it would either have to be done in a
MessageHandler that implemented that rule, or possibly by having the
encoder just check for signature and throw if not there.<br>
<br>
<blockquote cite="mid:CF1990B5.86CF%25cantor.2@osu.edu" type="cite">
<pre wrap="">
I don't recall what V2 does if you set signing to "never" for both
assertions and responses. If that doesn't fail, then we're already in that
mode I guess.
</pre>
</blockquote>
<br>
I'd have to go back and check but I don't recall us failing in that
case. I think it does what you tell it and if you shoot yourself,
that's your right. :-) But not 100% sure.<br>
<br>
(Unfortunately I can't check any of this until I get home b/c my
Shib Eclipse workspace on my work computer is corrupted at the
moment).<br>
</body>
</html>