<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<br>
<br>
<div class="moz-cite-prefix">On 8/20/15 10:26 PM, Cantor, Scott
wrote:<br>
</div>
<blockquote cite="mid:A290AEF0-1846-46CF-8F3D-5C169A06911B@osu.edu"
type="cite">
<pre wrap="">On 8/20/15, 10:23 PM, "dev on behalf of Brent Putman" <a class="moz-txt-link-rfc2396E" href="mailto:dev-bounces@shibboleth.netonbehalfofputmanb@georgetown.edu"><dev-bounces@shibboleth.net on behalf of putmanb@georgetown.edu></a> wrote:
</pre>
<blockquote type="cite">
<pre wrap="">
Maybe something on the profile config bean could work. Because of the reloadability I'm assuming you don't mean inject credential beans directly, but rather something that exposes them or uses them.
</pre>
</blockquote>
<pre wrap="">
Well, I was responding to the original thread and I meant injecting them directly because the profile config beans and the credential beans are currently both inside the RP service context.</pre>
</blockquote>
<br>
Oh, right, they're in the same context, I forgot. That makes sense.<br>
<br>
<blockquote cite="mid:A290AEF0-1846-46CF-8F3D-5C169A06911B@osu.edu"
type="cite">
<pre wrap="">
I realize that in theory, yes, you can define credentials in disconnected places in that configuration and attach them directly to things, but in practice they'd be in credentials.xml and referenced where needed.
I don't think it's a bad idea to have a credential "service", but I don't know that it's 100% required.
</pre>
</blockquote>
<br>
<br>
I'll think about that. That aspect might be easier, but as I said,
right now the components assume they are going to be wired in the
flow beans. I don't "resolve" the Assertion validator or its
constituent SignatureTrustEngine for example. To use creds injected
on the profile config I think I'd have to switch some things to be
constructed on the fly at runtime based on the injected creds. So
that part would be more complex.<br>
<br>
Actually there's also the issue of *which* profile config. I think
it's also back to the "to whom did I sign" question. Unless we just
injected the all the creds on all the profile configs (on the
abstract one, etc). Then we could pick anyone (e.g. the one already
resolved for the SAML requester). But that sort of doesn't feel
right. <br>
<br>
<br>
</body>
</html>