<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<br>
<br>
<div class="moz-cite-prefix">On 8/20/15 10:05 PM, Cantor, Scott
wrote:<br>
</div>
<blockquote cite="mid:640CB4B4-7B8E-4719-B0AC-0562719272A8@osu.edu"
type="cite">
<pre wrap="">On 8/20/15, 10:00 PM, "dev on behalf of Brent Putman" <a class="moz-txt-link-rfc2396E" href="mailto:dev-bounces@shibboleth.netonbehalfofputmanb@georgetown.edu"><dev-bounces@shibboleth.net on behalf of putmanb@georgetown.edu></a> wrote:
</pre>
<blockquote type="cite">
<pre wrap="">No, I don't think so. There could be many signing creds and the exact one that was used certainly can't be assumed to be in the default list. It might have been an RP-specific one not specified in the default SecurityConfiguration.
</pre>
</blockquote>
<pre wrap="">
I'm not sure we necessarily have to make it that complex.
</pre>
</blockquote>
<br>
I wasn't referring to doing some complex config for delegation.
Just that there can be many SecurityConfiguration instances: the
default one and then ones at other levels. That's already true
today. Rod mentioned using just the default one, and that won't work
b/c it obviously doesn't necessarily include them all.<br>
<br>
<blockquote cite="mid:640CB4B4-7B8E-4719-B0AC-0562719272A8@osu.edu"
type="cite">
<pre wrap="">
The intention is that the credentials would be declared in one place, even if they're applied/used in different situations.
</pre>
</blockquote>
<br>
Totally agreed, they should all be defined in one place
(conf/credentials.xml). Else insanity ensues.<br>
<br>
<blockquote cite="mid:640CB4B4-7B8E-4719-B0AC-0562719272A8@osu.edu"
type="cite">
<pre wrap="">
</pre>
<blockquote type="cite">
<pre wrap="">Either way, the thing I guess I would need agreement on is that: in order for this to work, I believe we'd need to assume a new bean structure in conf/credentials.xml. We'd need to have the deployer wrap all the defined signing credentials in a new list, e.g.
</pre>
</blockquote>
<pre wrap="">
Granted, what I'm suggesting would still have to presume a surrounding structure that's not currently there.
But if you want to do the work of creating a CredentialService, which certainly isn't a bad thing, we probably should migrate everything to that and come up with a way to do that backward-compatibly.</pre>
</blockquote>
<br>
I was wondering whether we should do something similar for the
encryption ones (the single list), just for symmetry. That seems
easy. If you're suggesting moving all credential usage to be via
the CredentialService, that seems more than what I needed. Unless
we just made the RP context a child of the CredentialService's
context, but I think that gets hairy, with the reloading and
everything. Yikes.<br>
<br>
Without that, wouldn't we need to basically inject Credential
proxies into current components? Where the proxy delegates to the
CredentialService.<br>
<blockquote cite="mid:640CB4B4-7B8E-4719-B0AC-0562719272A8@osu.edu"
type="cite">
</blockquote>
<br>
</body>
</html>