SAML2SignatureGenerationHandler

Objective

Handles SAML Signature Generation. This handler uses the configuration provided in the KeyProvider to sign SAML messages.

Considering the IDP, the default behavior when returning SAML Response messages is to sign only the Response element. You can change this behavior using some of the configuration parameters provided by this handler.

Fully Qualified Name

org.picketlink.identity.federation.web.handlers.saml2.SAML2SignatureGenerationHandler

Configuration

Should be configured in WEB-INF/picketlink.xml.

Example:

<Handlers xmlns="urn:picketlink:identity-federation:handler:config:2.1">
    <Handler class="org.picketlink.identity.federation.web.handlers.saml2.SAML2IssuerTrustHandler" />
    <Handler class="org.picketlink.identity.federation.web.handlers.saml2.SAML2LogOutHandler" />
    <Handler class="org.picketlink.identity.federation.web.handlers.saml2.SAML2AuthenticationHandler" />
    <Handler class="org.picketlink.identity.federation.web.handlers.saml2.RolesGenerationHandler" />
    <Handler class="org.picketlink.identity.federation.web.handlers.saml2.SAML2SignatureGenerationHandler" />
    <Handler class="org.picketlink.identity.federation.web.handlers.saml2.SAML2SignatureValidationHandler"/>
</Handlers>

Configuration Parameters

#	Name	Type	Objective	Default Value	SP/IDP	Since Version
1	SIGN_ASSERTION_ONLY	boolean	Indicates if only the Assertion should be signed by the IDP when returning a SAML Response.	false	IDP	2.5.3.Beta1
2	SIGN_RESPONSE_AND_ASSERTION	boolean	Indicates if both the SAML Response and Assertion should be signed.	false	IDP	2.5.3.Beta1
3	SIGN_METHOD	String	Specify the signature method algorithm. Eg.: http://www.w3.org/2001/04/xmldsig-more#rsa-sha256 .	http://www.w3.org/2000/09/xmldsig#rsa-sha1\\	Both	2.6.0.Final
4	SIGN_DIGEST	String	Specify the signature digest method algorithm. Eg.: http://www.w3.org/2001/04/xmlenc#sha256	http://www.w3.org/2000/09/xmldsig#sha1\\	Both	2.6.0.Final