<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<br>
<div class="moz-cite-prefix">On 12/15/14 2:51 PM, Sandy wrote:<br>
</div>
<blockquote
cite="mid:CA+4cBy5-CuKTSCCwGmk9sHS755X9rjVC21EhEh0P+A5VfuKJBw@mail.gmail.com"
type="cite">
<div dir="ltr">
<div>
<div>
<div>
<div>Thank you Brent.<br>
<br>
</div>
The SP is built with OpenSAML Java(2.6.3). Like you
correctly guessed, at the moment I am looking to resolve a
Credential from KeyInfo. </div>
</div>
</div>
</div>
</blockquote>
<br>
We have a KeyInfoCredentialResolver exactly for that purpose.
That's an interface. For the signature validation processing case,
the main impl to look at is:<br>
org.opensaml.xml.security.keyinfo.BasicProviderKeyInfoCredentialResolver.<br>
<br>
You can get a basic instance of that with the typical providers
already wired in (suitable for your use case) from:<br>
<meta http-equiv="content-type" content="text/html;
charset=windows-1252">
Configuration.getGlobalSecurityConfiguration().getDefaultKeyInfoCredentialResolver()<br>
<br>
The unit tests should give you usage examples.<br>
<br>
<br>
<br>
<blockquote
cite="mid:CA+4cBy5-CuKTSCCwGmk9sHS755X9rjVC21EhEh0P+A5VfuKJBw@mail.gmail.com"
type="cite">
<div dir="ltr">
<div>
<div>
<div><br>
</div>
Thank you for the advise on establishing trust. I now
understand how important it is and I would implement it. The
more complex example at the bottom serves as a great
resource for this. <br>
<br>
</div>
</div>
</div>
</blockquote>
<br>
That example illustrates the trust establishment using SAML
metadata, b/c that is the trusted CredentialResolver that is
specified. If you wanted to use a different source of trusted
Credentials for the ExplicitKeySignatureTrustEngine, you would just
swap out the metadata-based one for a different one. There are
several CredentialResolver impls.<br>
<br>
<br>
<blockquote
cite="mid:CA+4cBy5-CuKTSCCwGmk9sHS755X9rjVC21EhEh0P+A5VfuKJBw@mail.gmail.com"
type="cite">
<div dir="ltr">
<div>If there happen to be examples citing the usage of
credential resolvers and a basic signature trust engine, it
would be great to know them. I plan on using a local trust
store at the SP for establishing the trust.<br>
</div>
</div>
</blockquote>
<br>
Well, that example in the wiki is pretty complete, as far as just
using the trust engine. Other than that, there's just unit tests
and the Shibboleth IdP, which is built on top of all of this. I
don't know what exactly you want to know, but if you have specific
questions, just post them here.<br>
<br>
--Brent<br>
<br>
</body>
</html>