sp signingAlg and digestAlg defaults and setting explicit values

[Cantor, Scott]

I am not aware of any case where it would default to SHA-1 anymore without being told to except in the OAEP encryption code, maybe not even there.

I would again suggest you just file bugs. I won't have time to review all this for a while, but barring any specific bugs or unintentional behaviors, all I can do is clean up the mistakes in the documentation once I can verify them.

> Is there some way I am missing that would allow you to set
> the "default" algorithm the same way that the "default" of
> not setting anything it all works, which would make it use
> said default if nothing better could be negotiated, but still
> use a better algorithm if available, or one that
> the idp actually supported if the "default" was not in that
> list?

No. It has no concept of "better" to begin with, so there would be no way for it to make that sort of determination. The point of the extension is that it was ordered so that if somebody makes a decision about better and worse, it's honored.

The only place it manually knows about any sort of order is in the metadata generator, and that was just arbitrary choice by me.

The SP doesn't have a metadata filter for algorithm metadata of course, so until it's able to use the Java code for that, there isn't a way to follow the best practice and just use metadata directly to drive it to handle exceptions, so the RelyingParty hack is all there is.

-- Scott