Use signing key on HSM to sign assertions

[Cantor, Scott]

> Basically I would like to customized the code/bean which does the assertion
> signing. This bean I would then customize to perform this signing using the
> private key on a HSM.

It doesn't work that way. That's much high layer stuff. Using an HSM is something generally done at the layer of the JCE and generally through PKCS-12. There would have to be code added to abstract the credential objects through a provider that also implements the RSA algorithm through the hardware. It isn't something anybody has done to my knowledge, and certainly not something anybody has ever documented, for the IdP itself.

I believe xmlsectool has some tested support for using PKCS12 keystores for signing, and that's more or less what would have to be done for the IdP, a JCE configured and then Java classes written to supply the credential interfaces the IdP relies on from such a keystore. We don't even formally have keystore support at all right now based on a review I did of the code recently.

It may be that the actual amount of new code needed is very small, but the path to getting to that code is not, if I were to guess. And configuring that stuff tends to be incredibly hard, and is inherently specific to each HSM, so impossible to effectively cover in any documentation, it's a ton of trial and error.

> The question is what configuration changes are required to only replace the
> functionality which does the assertion signing? Which bean/beans need to
> be customized ?

It is not that simple, not by a long shot. It's an enhancement request at best.

-- Scott