[CXF-5443] STS Symmetric HOK: using server endpoint (AppliesTo) as certificate identifier to encrypt symmetric key

• Type: New Feature
• Status: Closed
• Priority: Minor
• Resolution: Fixed
• Affects Version/s: 3.0.0-milestone1
• Fix Version/s: 3.0.0-milestone2
• Component/s: STS
• Estimated Complexity: Unknown
• Assignee: Andrei Shakirin
• Reporter: Andrei Shakirin
• Created: 08/Dec/13 16:41
• Updated: 11/Jul/14 12:50
• Resolved: 31/Dec/13 10:48

Description

Currently in case of using SAML SymmetricKey HolderOfKey STS should know all services certificates for which he issues the tokens.
If I deploy a new service, it is necessary to:
a) add service certificate into STS keystore as trusted entry;
b) configure alias (encryptionUserName) in appropriate STS Service/ServiceMBean

I think XKMS can useful even for SAML SymmetricKey HolderOfKey scenario to resolve certificates lookup.

We can extend XKMS with new ApplicationId, that service certificates can be searched on the base of service endpoint.

STS will recognize this case due a special constant for encryptionName and will replace that with AppliesTo attribute.