Use signing key on HSM to sign assertions

[ofaklintrafo]

Thank you for all the feed back on my questions.

I understand that a general configuration of Shibboleth to support
integration to a HSM would be require a lot of work and does not fit well
into the design of Shibboleth and OpenSAML.

And this will make this difficult to inject custom configuration to do the
assertion signing using a private key on a HSM.

But what if I instead of signing the assertions could sign the response
document.

My IDP is configured to handle SAML 2 SP-Initiated SSO.

In shibboleth.DefaultRelyingParty profileConfigurations I would then
configure the SAML2.SSO bean to only encrypt the assertions using the
encryption key provided in the credentials/idp-encryption.key-file.

Shibboleth would not be configured to sign the assertions or the response
(signAssertions=false and signResponses=false)

Before the final XML response is returned to the service provider I would
need to have the document signed by the HSM. I have the Java code which can
properly sign the XML document and which should be able to produce the same
signature format as the opensaml ApacheSantuarioSignerProviderImpl.

My questions are:
  * If I configure Shibboleth to neither sign the assertions or  the
response, can I inject my document signer implementation as an outbound
interceptor (as mentioned here:
https://wiki.shibboleth.net/confluence/display/IDP30/ProfileHandling#ProfileHandling-OutboundInterceptContract).
If this is so, it there an example of an outbound interceptor ? I can only
find examples of inbound and post authentication interceptors in the
Shibboleth code.
   * Or how to I best intercept the response from the SAML2.SSO flow so that
I can use my custom java code to sign the document before it is returned to
the service provider?
 



--
Sent from: http://shibboleth.1660669.n2.nabble.com/Shibboleth-Users-f1660767.html