<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body text="#000000" bgcolor="#FFFFFF">
Mostly for Scott or maybe Ian:<br>
<br>
Question 1:<br>
<br>
In the spec (section 2.5 Metadata Consumers) it says:<br>
<br>
<blockquote type="cite">With respect to use of XML Signature, the
presence of any <alg:DigestMethod> and
<alg:SigningMethod> elements at the level of a role element
MUST take precedence over any such elements at the level of of an
<md:EntityDescriptor> element, and the two sets are not
combined if both are present.</blockquote>
<br>
I'm having trouble parsing this sentence (entirely possibly b/c it's
Friday... ). I see at least two possible meanings:<br>
<br>
1) The presence of EITHER a SigningMethod OR a DigestMethod at the
RoleDescriptor level means you ONLY consider the RoleDescriptor
level for *both* elements.<br>
<br>
2) SigningMethod and DigestMethod are considered separately, e.g.
the presence of a SigningMethod on the RoleDescriptor does not
preclude using the DigestMethod on the EntityDescriptor IF the
RoleDescriptor has no DigestMethods. And vice versa.<br>
<br>
I guess the "... over any such elements ..." part is unclear to me,
whether the "such" refers to the 2 elements together as a set, or
separately.<br>
<br>
(It's clear that in either case you don't combine same-named
elements from both RoleDescriptor and EntityDescriptor.)<br>
<br>
Opinions? If it's not just me, maybe a question for saml-dev, or a
potential errata to clarify.<br>
<br>
I've currently implemented it as #1, but easy enough to change.<br>
<br>
<br>
<br>
<br>
Question 2:<br>
<br>
A resolver processing edge case: For both signing and encryption, if
there are algorithms present in metadata but the local
whitelist/blacklist policy winds up filtering them all out: Are we
then free to choose from the local list of preferred algorithms
(which basically means falling back to the non-SAML-aware resolver
superclass logic)? Or do we just fail to resolve? Off-hand I'd
think we do the former and at least resolve something usable, but
wanted to get feedback first.<br>
<br>
<br>
--Brent<br>
</body>
</html>