You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@cxf.apache.org by Oliver Wulff <ow...@talend.com> on 2011/10/31 13:40:59 UTC
STS, SAMLRealm, signatureProperties
Hi all
I'm working with the CXF STS and came across the following issue:
I've configured several realms where each realm uses a different certificat/private key to sign the saml assertion. Every keystore (pkcs12 / jks) contains only one private key/cert.
I can configure a signatureAlias per SAMLRealm but I can't configure a signaturePropertiesFile per SAMLRealm. I think it would make sense to allow to configure the following attributes per SAMLRealm:
CallbackHandler
SignatureProperties
signaturePropertiesFile
which has higher priority than the global settings in StaticSTSProperties.
What are your thoughts?
Thanks
Oli
AW: STS, SAMLRealm, signatureProperties
Posted by Oliver Wulff <ow...@talend.com>.
JIRA raised:
https://issues.apache.org/jira/browse/CXF-3924
________________________________________
Von: Colm O hEigeartaigh [coheigea@apache.org]
Gesendet: Mittwoch, 2. November 2011 10:16
Bis: users@cxf.apache.org
Betreff: Re: STS, SAMLRealm, signatureProperties
Hi Oli,
> I can configure a signatureAlias per SAMLRealm but I can't configure a signaturePropertiesFile per SAMLRealm. I think it would make sense to allow to configure the following attributes per SAMLRealm:
> CallbackHandler
> SignatureProperties
> signaturePropertiesFile
I agree. We don't need different properties for SignatureProperties
and signaturePropertiesFile, a single one will do, and the internal
logic will decide whether it is a class, filename, object, etc. Could
you file a JIRA?
Colm,
On Mon, Oct 31, 2011 at 12:40 PM, Oliver Wulff <ow...@talend.com> wrote:
> Hi all
>
> I'm working with the CXF STS and came across the following issue:
> I've configured several realms where each realm uses a different certificat/private key to sign the saml assertion. Every keystore (pkcs12 / jks) contains only one private key/cert.
>
> I can configure a signatureAlias per SAMLRealm but I can't configure a signaturePropertiesFile per SAMLRealm. I think it would make sense to allow to configure the following attributes per SAMLRealm:
> CallbackHandler
> SignatureProperties
> signaturePropertiesFile
>
> which has higher priority than the global settings in StaticSTSProperties.
>
> What are your thoughts?
>
> Thanks
> Oli
>
>
>
--
Colm O hEigeartaigh
http://coheigea.blogspot.com/
Talend - http://www.talend.com/apache
Re: STS, SAMLRealm, signatureProperties
Posted by Colm O hEigeartaigh <co...@apache.org>.
Hi Oli,
> I can configure a signatureAlias per SAMLRealm but I can't configure a signaturePropertiesFile per SAMLRealm. I think it would make sense to allow to configure the following attributes per SAMLRealm:
> CallbackHandler
> SignatureProperties
> signaturePropertiesFile
I agree. We don't need different properties for SignatureProperties
and signaturePropertiesFile, a single one will do, and the internal
logic will decide whether it is a class, filename, object, etc. Could
you file a JIRA?
Colm,
On Mon, Oct 31, 2011 at 12:40 PM, Oliver Wulff <ow...@talend.com> wrote:
> Hi all
>
> I'm working with the CXF STS and came across the following issue:
> I've configured several realms where each realm uses a different certificat/private key to sign the saml assertion. Every keystore (pkcs12 / jks) contains only one private key/cert.
>
> I can configure a signatureAlias per SAMLRealm but I can't configure a signaturePropertiesFile per SAMLRealm. I think it would make sense to allow to configure the following attributes per SAMLRealm:
> CallbackHandler
> SignatureProperties
> signaturePropertiesFile
>
> which has higher priority than the global settings in StaticSTSProperties.
>
> What are your thoughts?
>
> Thanks
> Oli
>
>
>
--
Colm O hEigeartaigh
http://coheigea.blogspot.com/
Talend - http://www.talend.com/apache