<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">
<pre style="color: rgb(0, 0, 0); font-family: Calibri, sans-serif; font-size: 14px; "><div>Hi All,</div></pre>
<pre><span style="color: rgb(0, 0, 0); font-family: Calibri, sans-serif; font-size: 14px; ">We are using XMLSec </span><span style="color: rgb(0, 0, 0); font-family: Calibri, sans-serif; font-size: 14px; ">to handle XML signature and encryption in </span><font face="Calibri,sans-serif">SAML 1.0 and 2.0 protocols. We are pre-configed the configuration data such as IDP certificate using metadata. So even the </font><font face="Calibri,sans-serif">response include "KeyInfo/X509Data", we will ignore it then </font><font face="Calibri,sans-serif">using local pre-config certificate to verify it a</font><font face="Calibri,sans-serif">nd we assume SP totally trust this </font><font face="Calibri,sans-serif">certificate. So also we won't use CA certificate to verify the pre-config certificate's legitimacy. </font></pre>
<pre><font face="Calibri">I dig into code then find:</font></pre>
<pre>/* ignore <dsig:KeyInfo /> if there is the key is already set */
/* todo: throw an error if key is set and node != NULL? */
if((dsigCtx->signKey == NULL) && (dsigCtx->keyInfoReadCtx.keysMngr != NULL)
&& (dsigCtx->keyInfoReadCtx.keysMngr->getKey != NULL)) {
dsigCtx->signKey = (dsigCtx->keyInfoReadCtx.keysMngr->getKey)(node, &(dsigCtx->keyInfoReadCtx));
}</pre>
<pre><font face="Calibri">Does it means I need to set dsigCtx->signKey? And what's meaning of dsigCtx->signKey? Is it private key from IDP? (we never can get private key from IDP). </font><span style="font-family: Calibri; ">How can I meet this requirement by xmlsec?</span></pre>
<pre><font face="Calibri"><br></font></pre>
<pre><font face="Calibri">Thanks,</font></pre>
<pre><font face="Calibri">Jeffrey</font></pre>
</body>
</html>