Comment 3 for bug 1802901

In Ubuntu we decided to support libapache2-mod-auth-mellon for keystone federation (https://launchpad.net/bugs/1610286). This was based on input from the security team at Canonical that xml-security-c code quality was lacking and it (and Xerces) were not well maintained at the time, and flaws could affect shibboleth. This doesn't solve the problem for this bug but may provide a work-around by using libapache2-mod-auth-mellon instead.