InlineX509DataProvider skips credential extraction if only X509SKI is present

[Brent Putman]

On 12/21/12 9:25 AM, Cantor, Scott wrote:
>
> The signature validation fails. Apparently the InlineX509DataProvider
> skips processing because it doesn't find any X509Certificate elements.
> The trust engine is ultimately using a variety of KeyInfo extraction code,
> not just X509Certificate. But I don't think the SKI is supported, no.

Right, it's not supported out of the box.  The provider-based KeyInfo
impl is pluggable and could easily be made to support SKI via a plugin. 
We don't supply one because this is one of the key-by-reference cases,
which requires some sort of key/cert store, indexed by appropriate
mechanisms to allow lookup via the reference.  It's not terribly hard to
do, but because there's so many possibilities for storage (e.g. files,
RDBMS, LDAP, Java keystore, etc), combined with the varying needs of
deployers, it doesn't make sense to do one without a specific use case.
So it's most likely to be a locally developed plugin based on specific
requirements. There's not a whole lot of generalized, abstracted code we
could supply.