SAMLart how built it?

[Brent Putman]

In the future, please don't contact me directly, instead address
questions to the list devoted to OpenSAML (and Shibboleth) development,
dev at shibboleth.net :

http://shibboleth.net/community/lists.html




On 12/3/12 9:45 AM, roldanhollow at gmail.com wrote:
> My name is Roldan, and I'm Java  Developer... 
> i'm developing app about SAML but i dont  knowed How build this... 
> Well...  finding and finding and Googling... i found info about this and how work... 
> And so,  i began to learn about this, looking images of how are steps.. 
> So.. I developed 2 app (IDP, SP) for POST via.... (with OpenSaml) 
> Now ... the business where i work need that build a IDP app, but the sp app (Costumer) need that us use the "Artifact" and the IDP app send them the SAMLart parameter. (with OpenSaml too) 


Requiring use of the Artifact binding is somewhat unusual.  It's much
more complex and difficult than the other SAML bindings. If they have
any possibility to use the POST or HTTP-Redirect bindings, I would
suggest that you use one of those.  


>
> Well...  i wanna question you the next... 
> How can build the SAMLart parameter? 
> What SAML object should use for build the SAMLart? (Java) 

Is this SAML 1 or SAML 2?  The param is capitalized slightly differently
for these 2 cases and the what you have literally written is the SAML 1
artifact variant.  They are very similar conceptually at a high level,
but in SAML 1 the artifact represents an Assertion and in SAML 2 it
represents any protocol message (which in SSO from an IdP is often a
Response containing an Assertion).

You'll want to look at the relevant artifact encoder for the SAML
version in question:

org.opensaml.saml2.binding.encoding.HTTPArtifactEncoder
org.opensaml.saml1.binding.encoding.HTTPArtifactEncoder

and all the classes that are reference by and required for use of these
encoders, like org.opensaml.common.binding.artifact.SAMLArtifactMap and
the various artifact builders and artifact impl classes.


> What I should be considered? 


There's at least a couple of important things to note:

1) Issuing an artifact - which is a message "by reference", rather than
"by value" -  is a stateful thing, meaning  you have to store the
referent across requests in order to be able to look it up and return it
when the recipient later de-references it. So you have to store it
somewhere in some fashion, which is what the component represented by
the SAMLArtifactMap interface does. So there's issues with storage
methodology (in-memory vs database vs whatever), longevity and storage
cleanup, etc.

2) If you send a message by artifact, you then have to also implement
the ArtifactResolutionService endpoint, usually for the SOAP binding,
which the recipient of the artifact later uses to de-reference the
artifact back into the message.  Aside from the mechanics of
implementing this additional service over the SOAP binding, you have to
address the issue of authenticating the artifact resolution request
message, using a mechanism like client TLS or SAML message signing.  So
security and crypto stuff adds complexity here.


> Could you give me a example? 

We don't really have any code examples for OpenSAML artifact usage,
unfortunately.  The only thing I can suggest would be to look at the
Shibboleth IdP, which does support outbound artifact issuance and
resolution.  That code is going to be harder to follow because of all
the other stuff around profile handling.  But implementing the artifact
binding is already going to be pretty convoluted anyway.  It is just by
nature much more complex than POST or Redirect.  That is why I suggest
that you not do Artifact binding if you can possibly avoid it,
especially if you are new to SAML.

>
> Really thanks.. for advance for your help!