Including keyName in keyInfo

[Brent Putman]

On 4/17/13 10:13 AM, Cantor, Scott wrote:
>
> The schema for the Credential element in the relying-party config appears
> to support a KeyName element. My speculation would be that might cause it
> to be inserted.

No, that alone won't do it unfortunately.  That just lets you attach a key name to the Credential. 
The contents of a signature's KeyInfo is based on the config of the KeyInfoGenerator that gets
called to generate a KeyInfo from the Credential.  On the default KeyInfoGenerator used throughout
the IdP, the flag to emit the Credential key names is false.  So the mere presence of the name on
the Credential won't do it.

We don't currently expose any way to configure that in the IdP.   It can be done with a pretty
simple bean (probably half a dozen lines of Java code) that you'd wire in internal.xml.  If the OP's
need is great, I can supply some guidance and/or code.  It would also be a global change, there's
currently no framework for per-relying-party config, etc.

Hopefully this will be more exposed for configuration in v3.


>
> I actually thought we did include key names generated from a certificate
> already.
>


No, not by default.  The X509KeyInfoGenerator *can* generate key names from the whole subject DN,
the CN of the subject and/or alt names, as well as the key names and entityID set directly on the
Credential (the latter 2 for any basic Credential type).  But those options all default to off in
the IdP.