Enabled fallback PKIX validation in default config

git-svn-id: https://subversion.switch.ch/svn/shibboleth/java-idp/trunk@2675 ab3bd59b-922f-494d-bb5f-6f0a3c29deca

diff --git a/resources/conf/relying-party.xml b/resources/conf/relying-party.xml
index e33ee3b..37f84dc 100644 (file)
--- a/resources/conf/relying-party.xml
+++ b/resources/conf/relying-party.xml
@@ -93,15 +93,7 @@
         secure.  Naturally some of these checks require the validation of the tokens evaluated by the trust 
         engines and so you'll see some rules that reference the declared trust engines.
     -->
-    
-    <security:TrustEngine id="shibboleth.SignatureTrustEngine" xsi:type="security:MetadataExplicitKeySignature"
-                              metadataProviderRef="ShibbolethMetadata" />
-                              
-    <security:TrustEngine id="shibboleth.CredentialTrustEngine" xsi:type="security:MetadataExplicitKey"
-                              metadataProviderRef="ShibbolethMetadata" />
-                              
-<!--
-    <security:TrustEngine id="shibboleth.SignatureTrustEngine" xsi:type="security:Chaining">
+    <security:TrustEngine id="shibboleth.SignatureTrustEngine" xsi:type="security:SignatureChaining">
         <security:TrustEngine id="shibboleth.SignatureMetadataExplicitKeyTrustEngine" xsi:type="security:MetadataExplicitKeySignature"
                               metadataProviderRef="ShibbolethMetadata" />                              
         <security:TrustEngine id="shibboleth.SignatureMetadataPKIXTrustEngine" xsi:type="security:MetadataPKIXSignature"
@@ -114,7 +106,6 @@
         <security:TrustEngine id="shibboleth.CredentialMetadataPKIXTrustEngine" xsi:type="security:MetadataPKIXX509Credential"
                               metadataProviderRef="ShibbolethMetadata" />
     </security:TrustEngine>
--->                      
      
     <security:SecurityPolicy id="shibboleth.ShibbolethSSOSecurityPolicy" xsi:type="security:SecurityPolicyType">
         <security:Rule xsi:type="samlsec:IssueInstant" required="false"/>