<html>
<head>
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
</head>
<body text="#000000" bgcolor="#FFFFFF">
Tom, <br>
I think this isn't quite right for the signing of assertions, re:
getting the Assertion signing SignatureSigningParameters from the
outbound message context. Doing that means you can't differentiate
between the cases of signing Assertions and signing Responses, which
are separate profile config options. The Assertion one needs to
live in a different place, presumably somewhere in the same context
subtree where you store intermediate data used in the profile
handling process. (That's what I meant when I said that the only
real decision regarding use of the security -Parameters is deciding
where they live for a given profile handling subsystem).<br>
<br>
<br>
<div class="moz-cite-prefix">On 2/6/14 6:55 PM,
<a class="moz-txt-link-abbreviated" href="mailto:noreply@shibboleth.net">noreply@shibboleth.net</a> wrote:<br>
</div>
<blockquote cite="mid:20140206235549.3927079281CC@shibboleth.net"
type="cite">
<pre wrap="">
Modified: trunk/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/impl/profile/saml1/SignAssertions.java
+ final MessageContext<Response> outboundMsgCtx = profileRequestContext.getOutboundMessageContext();
+ if (outboundMsgCtx == null) {
+ log.debug("{} No outbound message context available", getId());
+ ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_MSG_CTX);
+ return false;
+ }
+
+ final SecurityParametersContext secParamCtx = outboundMsgCtx.getSubcontext(SecurityParametersContext.class);
+ if (secParamCtx == null) {
+ log.debug("{} Will not sign assertions because no security parameters context is available", getId());
+ return false;
+ }
+
+ signatureSigningParameters = secParamCtx.getSignatureSigningParameters();
+ if (signatureSigningParameters == null) {
+ log.debug("{} Will not sign assertions because no signature signing parameters available", getId());
+ return false;
+ }
+
</pre>
</blockquote>
<br>
</body>
</html>