<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<br>
<br>
<div class="moz-cite-prefix">On 10/29/15 5:51 PM, Cantor, Scott
wrote:<br>
</div>
<blockquote cite="mid:51321780-A7B9-4273-843B-0D8052F943FD@osu.edu"
type="cite">
<pre wrap="">Brent, it looks like the message-signing message handler just signs unconditionally, which is fine,</pre>
</blockquote>
<br>
Yeah, thinking about it, I think design-wise my intent was that
you'd have (potentially) a different set of outbound handlers for
each binding. But for outbound, the binding is dynamic and we
didn't do anything like that. I see now that what we actually did
is just have one common outbound handler chain for all SSO flows,
i.e. for SAML 2 just one chain (shibboleth.PreEncodeMessageHandler)
defined in sso-abstract-beans.xml.<br>
<br>
<br>
<blockquote cite="mid:51321780-A7B9-4273-843B-0D8052F943FD@osu.edu"
type="cite">
<pre wrap=""> but do I need to just attach a condition to it from the outside to check for the other bindings or is there a more elegant way?</pre>
</blockquote>
<br>
Since it's probably a pretty big change to do the above, having an
activationCondition for it nominally sounds fine. But of course
it's not an (adapted) Action, it's just a raw MessageHandler inside
a chain, and those don't have activation conditions natively. Would
have to wrap that individual handler in the Action adapter, I think.<br>
<br>
I suppose it might not be wrong to special case this directly inside
that handler, and have say its doPreInvoke check whether the binding
(via BindingDescriptor) supports signing.<br>
<br>
<blockquote cite="mid:51321780-A7B9-4273-843B-0D8052F943FD@osu.edu"
type="cite">
<pre wrap="">
IIRC, wasn't the signing in V2 inside the encoders?
</pre>
</blockquote>
<br>
I had to double-check. Yes, it was, and that's how we handled it,
in each concrete binding impl. The Redirect one just doesn't call
the XML protocol message signMessage(..) method. The POST
SimpleSign one actually has a boolean (default false) as to whether
it should sign the XML message in addition to the binding signature.<br>
<br>
<blockquote cite="mid:51321780-A7B9-4273-843B-0D8052F943FD@osu.edu"
type="cite">
<pre wrap="">
I don't think we have had this case come up or at least I didn't note it. </pre>
</blockquote>
<br>
Yeah, totally didn't register with me. Might have if I'd paid any
attention to the initial flow wiring, but I was off on other things
at that point.<br>
<br>
<br>
<blockquote cite="mid:51321780-A7B9-4273-843B-0D8052F943FD@osu.edu"
type="cite">
<pre wrap="">I think it's already been happening during the V3 logout response code, and it's come up again where I'm issuing LogoutRequests.
</pre>
</blockquote>
<br>
Yeah, it's likely not been a practical issue for the IdP up to this
point since POST doesn't have binding signature, Redirect isn't
usable for SSO responses, and nobody really uses POST SimpleSign.
Makes sense that you're now hitting it with a flow that generates
responses using Redirect binding.<br>
<br>
<br>
<blockquote cite="mid:51321780-A7B9-4273-843B-0D8052F943FD@osu.edu"
type="cite">
</blockquote>
<br>
</body>
</html>