Marshalling RequestSecurityToken

[Brent Putman]

On 3/19/12 6:02 PM, Gina Choi wrote:

> Last time you mentioned marshalling RequestSecurityToken, but I wasn't quite
> understand at that time. Marshalling makes sense when we send SAMLRequest to
> STS since we are going to invoke following code.
> 
> response.sendRedirect(actionURL + "?SAMLRequest="
> 				+ encodedRequestMessage + "&RelayState=" +
> relayUrl);
> 
> 



Well, don't confuse "marshalling" with "serializing".  In OpenSAML,
marshalling is defined as converting the XMLObject tree model into a DOM
model.  Serializing is converting the DOM representation into a byte
sequence, i.e. for transmission of a communication channel, storage in a
file, etc.

Ultimately some code, somewhere, is going to have to do both of those
things.  Whether or not you explicitly have to do either depends on how
you handle the processing of the XMLObject that you create (see below
for SOAP client info).

And the same is tree when you receive the XML, as pertains to
deserializing/parsing the XML into a DOM, and then unmarshalling an
XMLObject tree from the DOM.




> But when we send RequestSecurityToken to STS over SOAP, we add
> RequestSecurityToken to Body. Following code is based on your wiki link. I
> did marshaled RequestSecurityToken, but it's purpose was to see xml structure
> of the RequestSecurityToken that I build. Just checking with you in case I
> missed something.
> 
> 
> 
>         Body body = (Body)
> bf.getBuilder(Body.DEFAULT_ELEMENT_NAME).buildObject(Body.DEFAULT_ELEMENT_NAM
> E);
>         
>         body.getUnknownXMLObjects().add(RequestSecurityToken);
>         envelope.setBody(body);
>         // SOAP context used by the SOAP client
>         BasicSOAPMessageContext soapContext = new BasicSOAPMessageContext();
> 
>         soapContext.setOutboundMessage(envelope);
> 		
>         HttpClientBuilder clientBuilder = new HttpClientBuilder();
> 
>         HttpSOAPClient soapClient = new
> HttpSOAPClient(clientBuilder.buildClient(), parserPool);
>         
>         // Send the message
>         soapClient.send(serverEndpoint, soapContext);
> 



Yes, on first glance that looks correct.

I had to go and take a look at it b/c it's been a long time, but the
SOAP client does take care of marshalling and serializing the outbound
XMLObject, and deserializing and unmarshalling the response.  So you
don't generally need to marshall the SOAP Envelope that you are sending
before you invoke the client.  One exception would be if you were doing
anything with XML signatures - in that case you have to marshall first
before the actual signing operation, since the signature process
operates on the DOM level.