<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<br>
<br>
<div class="moz-cite-prefix">On 7/16/15 2:13 PM, Cantor, Scott
wrote:<br>
</div>
<blockquote cite="mid:F0C7AA37-A6F1-40E2-8142-8D7474EBD98F@osu.edu"
type="cite">
<pre wrap="">On 7/16/15, 7:57 AM, "dev on behalf of Stefan Rasmusson" <a class="moz-txt-link-rfc2396E" href="mailto:dev-bounces@shibboleth.netonbehalfofrasmusson.stefan@gmail.com"><dev-bounces@shibboleth.net on behalf of rasmusson.stefan@gmail.com></a> wrote:
</pre>
<blockquote type="cite">
<pre wrap="">Im trying to add KeyInfo to my signature. I have tried using SecurityHelper.prepareSignatureParams(signature,
signingCredential, secConfig, keyInfoGeneratorProfile);but this does not add the x509 properties like issuer name etc.
How can I generate a keyinfo with these properties?
</pre>
</blockquote>
<pre wrap="">
Brent question, I only know what the IdP does and it basically does what we wanted it to, which I think is just based on OpenSAML defaults:
// Generator for X509Credentials
X509KeyInfoGeneratorFactory x509Factory = new X509KeyInfoGeneratorFactory();
x509Factory.setEmitEntityCertificate(true);
x509Factory.setEmitEntityCertificateChain(true);
</pre>
</blockquote>
<br>
<br>
That's correct, what it emits is determined by the flags set on the
factory. The X509 one has a lots of options, which are generally
the emit* methods.<br>
<br>
This looks like v2 and presumably you are calling the above helper
method with null for both the secConfig and keyInfoGeneratorProfile
params? In that case, what you effectively get is the default
factory from the global SecurityConfiguration, which essentially
comes from here:<br>
<br>
<tt>Configuration.getGlobalSecurityConfiguration().getKeyInfoGeneratorManager().getDefaultManager()<br>
<br>
<br>
</tt>You can either 1) pass a custom instance of
SecurityConfiguration there, or 2) just augment the global instance
with what you want. #2 is probably easier since you don't have to
build up all the other stuff.<br>
<br>
For #2, you can either:<br>
<br>
A) globally change the settings on the registered default
X509KeyInfoGeneratorFactory on the default manager by finding the
Factory via this and changing it:<br>
<br>
<tt>Configuration.getGlobalSecurityConfiguration().getKeyInfoGeneratorManager().getDefaultManager().getFactories();</tt><br>
<br>
Check and cast for the X509 one and then mutate it. Be advised,
that will change what you emit for *all* X509Credentials.<br>
<br>
<br>
B) register a new named factory in the manager using:<br>
<br>
<tt>Configuration.getGlobalSecurityConfiguration().getKeyInfoGeneratorManager().registerFactory("yourName",
yourFactory);</tt><tt><br>
</tt><br>
And then when you call prepareSignatureParams, pass "yourName" as
the keyInfoGeneratorProfile param.<br>
<br>
<br>
That's a pretty brief sketch. Let me know if you have questions.<br>
<br>
--Brent<br>
<br>
<blockquote cite="mid:F0C7AA37-A6F1-40E2-8142-8D7474EBD98F@osu.edu"
type="cite">
</blockquote>
<br>
</body>
</html>