/**
   * Populates X509 Credential used to authenticate this machine against peer servers. Uses key with
   * alias specified in extended metadata under TlsKey, when not set uses the default credential.
   *
   * @param samlContext context to populate
   */
  protected void populateSSLCredential(SAMLMessageContext samlContext) {

    X509Credential tlsCredential;
    if (samlContext.getLocalExtendedMetadata().getTlsKey() != null) {
      tlsCredential =
          (X509Credential)
              keyManager.getCredential(samlContext.getLocalExtendedMetadata().getTlsKey());
    } else {
      tlsCredential = null;
    }

    samlContext.setLocalSSLCredential(tlsCredential);
  }