OpenSAML user discussion

["Scott Cantor" <>]

I'm sending this mostly for Andreas' benefit since he had questions and some
concerns about the message decoders and how the issuer information was being
exposed.

After some discussion in Chicago last week, I'm going to take another design
pass over the SecurityPolicy/PolicyRule APIs and classes, and change how
some of the rules work.

To match the Java's design, message issuer information will be extracted by
a specific policy rule and placed into the policy regardless of subsequent
error handling. Signature or TLS rules will rely on that rule running,
rather than doing the work themselves, which means that if the issuer is
identified, it will be available from the policy object even if decoding
fails afterward, rather than attaching that information to the exception.

To ensure that authentication happens, wrapper rules will be provided that
allow sets of rules to be run such that at least one succeeds, making it
possible to assume that messages have been authenticated if the decoder
returns without an error.

The policy API will be extended a bit to also expose certain other message
details to the caller even if the decoder fails, like message type, ID, and
so forth.

Anyway, Andreas, you should take a look once I'm done and I'll listen to any
more suggestions.

-- Scott