What's wrong in my Shibboleth SP 2.6.0?

[Cantor, Scott]

> Btw, xmlsec1 takes 1.6 seconds (and less than 1s on repeated calls) to
> verify that same file, on the same system. Though that might be due to
> the SP (and samlsign) performing additional checks, not sure.

Not enough to explain that much of a difference. Streaming the file instead of using the DOM would explain it, and that's nominally possible with very specific signature rules, but I wouldn't think xmlsec would know enough to be doing that.

xmlsec's main problem at the time was maturity, and a lack of decent APIs for getting key material in and out to offload the trust processing, it was very much the "here's a CA list, tell me the answer" type of thing. And it's C, not C++, so it was a tortuous sort of API to use.

In a perfect world though we'd have the resources to replace Xerces with libxml and go back and redo it all.

-- Scott