AlgorithmRegistry indexes signing algorithms only by key type + digest

Don’t have a workable solution yet for how to uniquely index signature algorithms. There are many permutations of possible additional indexable criteria. One approach might involve supporting an additional passed AlgorithmParameters object, or something like that. But I think it’s likely very complex and a lot of work. For example, we’d probably have to have wrappers for all the Java ones to implement #hashcode()and #equals() to make it all work.

Given that we aren’t even using this currently, what I’ve done is deprecate the existing SignatureAlgorithm #getSignatureAlgorithm(...) method, and added a new Set<SignatureAlgorithm> get SignatureAlgorithms(...)method (plural). So the caller can just get all matching ones and filter on them from there if there are multiple.

This seems like a good middle ground unless/until we have a more concrete use case and a better solution.

(As an aside I realized that in addition to the RSA vs RSASSA-PSS conflict, there was already an existing conflict with the JOSE/OAuth2/OIDC stuff from those plugins if present. Those have the same key and digest algos as existing SAML ones, but different URIs (or “URIs” in the OIDC case, since they aren’t really URIs. ).