OpenSAML dependency on Velocity breaks application

[Chad La Joie]

OpenSAML uses velocity for things like generating the body for the
SAML 1 and 2 POST bindings.  So, if all you're not using the binding
layer you don't need it.

To get rid of it, dump the dependency and create your own boostrap
class.  It's quite likely there are other things you can leave out too
(e.g., XACML support).

On Fri, Apr 27, 2012 at 04:05, Tom van den Berge
<tom.vandenberge at gmail.com> wrote:
> Hi,
>
> I'm using the OpenSAML library to use single-sign-on in my web application.
> I noticed that OpenSAML has a dependency on Apache Velocity, and is
> initializing it when calling DefaultBootstrap.bootstrap().
>
> The problem is that my web application also uses Velocity, and that Velocity
> is initialized in a static way; that is, it can be initialized only once per
> VM. The result is that OpenSAML "hijacks" Velocity, and the initialization
> performed by my web application is ignored, which effectively breaks my
> application! In other words, it looks like OpenSAML can't be used in
> applications that use Velocity.
>
> I way quite surprised to learn that OpenSAML is using Velocity; for the
> purpose I'm using OpenSAML (generating AuthRequest and verifying
> Assertions), I can't really think of a reason to use Velocity. Maybe it is
> used by a specific part of the library that I don't use? Then, it would be
> highly recommended to make the dependency on Velocity optional. I don't
> think that is possible now?
>
> Is there a way to use or configure OpenSAML in such a way that it doesn't
> conflict with my own Velocity configuration?
>
>
> Many thanks,
>
> Tom
>
> --
> To unsubscribe from this list send an email to
> dev-unsubscribe at shibboleth.net



-- 
Chad La Joie
www.itumi.biz
trusted identities, delivered