Configuring EncryptionMethod for each credential?

[Cantor, Scott]

On 12/8/14, 10:22 AM, "Alex Stuart" <alex.stuart at ed.ac.uk> wrote:

>Does the Shibboleth SP have a way to configure specific encryption 
>methods for each key through the CredentialResolver element?

I'm not sure what you're after, but in general you wouldn't do that for 
decryption, that's more of a signing issue, but we don't think of this as 
a credential issue. Algorithms are set based on the identity of the peer, 
and you can also select credentials based on the peer.

But decryption algorithms are't really configured, they're just supported 
(or not), and triggered by what's in the message.

>I don't see anything on 
>https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPCredentialRes
>olver, 
>although the code in cpp-xmltooling looks sufficiently general to 
>support it (I've only skimmed that code). It also looks like the 
>configuration in security-policy.xml is for the whole SP deployment.

If you mean the whitelists or blacklists, yes, they're global. The new IdP 
can do them per-RP, but the SP's are global only.

-- Scott