OpenSAML user discussion

["Scott Cantor" <>]

> Is this right?For now I just evaluates the credential against it self for
> testing, which is built from the public key inside the <dsX509Certificate>
> element in the saml assertion, it returns true so I hope this is right,
but
> since it's my first time I wanted some feedback

I can't tell if you're asking this in the sense of "am I grasping how the
classes work" or if you're asking in a business context whether "this is a
reasonable thing to do". I always try and emphasize this, so forgive me if
you understand this already, but...

NEVER evaluate the signing key against what's inside the message. KeyInfo is
a hint about what was used. The trust evaluation MUST compare what was used
against a completely separate source of trusted information. In our project,
we believe that source should be metadata, but as a developer, you can use
anything you feel is appropriate. As long as it's *not* the KeyInfo inside
the message.

Again, ignore me if you know all this. But a lot of people don't, and they
end up with worthless code.

-- Scott