Including keyName in keyInfo

[Brent Putman]

On 4/19/13 2:21 PM, Matheesha Weerasinghe wrote

>  
> My interest here is to test some interoperability stuff with AD FS 2.0. Its for use in a lab
> environment.

Does ADFS really require a key name like that?  I think other people have interoped with ADFS and
didn't have that requirement.



>  
> So if you could give some instructions, I have a java developer who I can get the help of to
> follow your instructions and try implement it here.


I forgot that I already had a little project that illustrates close to the same thing for
customizing some XML Encryption behavior, so I just added this to it and threw it in Subversion. You
can checkout from the Subversion URL below [1].  Basically check out and do an 'mvn package'.  The
install docs are in doc/INSTALL.txt.

The extension is just hardcoded to enable the emitKeyNames flag on the KeyInfoGenerators.  As Scott
mentioned, you'd need to then populate the KeyName element on the Credential config in the IdP. 
This extension should then let those get expressed if they are present.

You could also easily add some code in the config bean to play around with some of the other
properties on the generators to emit KeyNames from the DN, CN and subject alt name cert info, as
well as any of the other generator properties.  See the OpenSAML Javadocs for details on all of
those options.

If there were enough interest to justify, the extension's config bean could be expanded to its
logical conclusion and expose property setters which would allow declarative config of most of the
OpenSAML global security configuration right in the internal.xml.

--Brent


[1]
https://svn.middleware.georgetown.edu/putmanb/shibboleth-idp-ext-opensaml-custom-security-config/trunk/