DataSealer dependencies

[Paul B. Henson]

> Cantor, Scott
> Sent: Monday, March 07, 2016 6:45 PM
> 
> If you set the option to save passwords in the authentication results. The
> password is stored in a Principal object but it's encrypted when it's stored in
> the session "at rest".

That would be this option in password-authn-config.xml which defaults to false?

<!-- Set to TRUE if you want the password kept in the resulting Subject as a private credential. -->
    <util:constant id="shibboleth.authn.Password.RetainAsPrivateCredential" static-field="java.lang.Boolean.FALSE"/>

I don't plan to change that, and you say the reference in the logout code isn't actually used, so I don't think I'm actually using it anywhere, so I should be safe to just have a stand-in file to make it start but not actually rotate it.

> Only if it's used for something.

Sorry, but in my state of confusion that's kind of like "Am I using it?" "Only if you're using it." ;). Thanks though, I think I've got it sorted out now :), and I see you have updated the bug and in version 3.3 hopefully it will be more clear and if you are not using it you can just not supply the data sealer key file at all.

Thanks...

--
Paul B. Henson  |  (909) 979-6361  |  http://www.cpp.edu/~henson/
Operating Systems and Network Analyst  |  henson at cpp.edu
California State Polytechnic University  |  Pomona CA 91768