Emrex 2.0 feedback

[PieterZeeuw]

Please feel free to post your Emrex 2.0 feedback here.

[pescheck-bram]

Hi @PieterZeeuw,

Thanks for opening this. From our side as an EMC implementing diploma retrieval, EMREX 2.0 looks good. The security improvements are a clear step forward particularly the stronger emphasis on XML signature verification of the ELMO payload.

One question: what's the recommended behaviour when EMREG is unreachable at callback time for signature key lookup hard-fail or soft-fail?

[PieterZeeuw]

Hello @pescheck-bram ,

You could use a fail-over caching strategy for Emreg. If you are not using that you'll have to deal with a hard fail since:
As EMP:

• can't authenticate clients
  As EMC:
• can't ask Emreg for EMP info
• can't verify the response payloads