<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<p><br>
</p>
<br>
<div class="moz-cite-prefix">On 9/18/18 9:09 AM, Cantor, Scott
wrote:<br>
</div>
<blockquote type="cite"
cite="mid:644A73B5-EB8B-45E6-A05B-E50438939BCB@osu.edu"><br>
<pre wrap="">
</pre>
<blockquote type="cite">
<pre wrap="">2. Metadata-based credential resolution is complicated by filtering
that can reduce the effective key set from what's patently defined in
metadata XML files.
</pre>
</blockquote>
<pre wrap="">
Not sure I followed that. I think the underlying code might support some name-based key filtering but I don't think it actually triggers all that often, and never on a redirect since there's no KeyInfo hint to feed into that kind of filtering.</pre>
</blockquote>
<br>
All of the concrete CredentialResolver impls fundamentally have this
capability, by virtue of inheriting from
AbstractCriteriaFilteringCredentialResolver, and the filtering
happens automagically if the right kind of criteria are supplied
(those that either are or can be mapped to a
Predicate<Credential>).<br>
<br>
As I just mentioned in my longish reply, the KeyInfo at issue here
was the metadata KeyDescriptor/KeyInfo. I don't *think* Marvin's
conclusions here were quite correct, as I believe there would not
have been any Credentials extracted from metadata to filter.<br>
<blockquote type="cite"
cite="mid:644A73B5-EB8B-45E6-A05B-E50438939BCB@osu.edu">
</blockquote>
<br>
</body>
</html>