Marshalling RequestSecurityToken

[Gina Choi]

Hi Brent,

Thanks for your response.

>Well, don't confuse "marshalling" with "serializing".  In OpenSAML,
>marshalling is defined as converting the XMLObject tree model into a DOM
>model.  Serializing is converting the DOM representation into a byte
>sequence, i.e. for transmission of a communication channel, storage in a
>file, etc.

>Ultimately some code, somewhere, is going to have to do both of those
>things.  Whether or not you explicitly have to do either depends on how
>you handle the processing of the XMLObject that you create (see below
>for SOAP client info).

>And the same is tree when you receive the XML, as pertains to
>deserializing/parsing the XML into a DOM, and then unmarshalling an
>XMLObject tree from the DOM.

I looked at AuthnRequest that I am sending to ADFS over HTTP POST, I do have
code that marshalling and serializing.


>Yes, on first glance that looks correct.

>I had to go and take a look at it b/c it's been a long time, but the
>SOAP client does take care of marshalling and serializing the outbound
>XMLObject, and deserializing and unmarshalling the response.  So you
>don't generally need to marshall the SOAP Envelope that you are sending
>before you invoke the client.  One exception would be if you were doing
>anything with XML signatures - in that case you have to marshall first
>before the actual signing operation, since the signature process
>operates on the DOM level.

I didn't know that SOAP client takes care of marshalling and serializing
role. Now I am clear. Thank you.

Gina

-----Original Message-----
From: dev-bounces at shibboleth.net [mailto:dev-bounces at shibboleth.net] On
Behalf Of dev-request at shibboleth.net
Sent: Wednesday, March 21, 2012 8:00 AM
To: dev at shibboleth.net
Subject: dev Digest, Vol 9, Issue 17

Send dev mailing list submissions to
	dev at shibboleth.net

To subscribe or unsubscribe via the World Wide Web, visit
	http://shibboleth.net/mailman/listinfo/dev
or, via email, send a message with subject or body 'help' to
	dev-request at shibboleth.net

You can reach the person managing the list at
	dev-owner at shibboleth.net

When replying, please edit your Subject line so it is more specific
than "Re: Contents of dev digest..."


Today's Topics:

   1. Re: Marshalling RequestSecurityToken (Brent Putman)
   2. Re: Apache 2.4 (Cantor, Scott)
   3. Re: Apache 2.4 (Michael R. Gettes)
   4. Requesting new Assertion to STS (Gina Choi)
   5. Re: Requesting new Assertion to STS (Cantor, Scott)


----------------------------------------------------------------------

Message: 1
Date: Tue, 20 Mar 2012 11:53:35 -0400
From: Brent Putman <putmanb at georgetown.edu>
Subject: Re: Marshalling RequestSecurityToken
To: dev at shibboleth.net
Message-ID: <4F68A7FF.9090403 at georgetown.edu>
Content-Type: text/plain; charset=ISO-8859-1



On 3/19/12 6:02 PM, Gina Choi wrote:

> Last time you mentioned marshalling RequestSecurityToken, but I wasn't
quite
> understand at that time. Marshalling makes sense when we send SAMLRequest
to
> STS since we are going to invoke following code.
> 
> response.sendRedirect(actionURL + "?SAMLRequest="
> 				+ encodedRequestMessage + "&RelayState=" +
> relayUrl);
> 
> 



Well, don't confuse "marshalling" with "serializing".  In OpenSAML,
marshalling is defined as converting the XMLObject tree model into a DOM
model.  Serializing is converting the DOM representation into a byte
sequence, i.e. for transmission of a communication channel, storage in a
file, etc.

Ultimately some code, somewhere, is going to have to do both of those
things.  Whether or not you explicitly have to do either depends on how
you handle the processing of the XMLObject that you create (see below
for SOAP client info).

And the same is tree when you receive the XML, as pertains to
deserializing/parsing the XML into a DOM, and then unmarshalling an
XMLObject tree from the DOM.




> But when we send RequestSecurityToken to STS over SOAP, we add
> RequestSecurityToken to Body. Following code is based on your wiki link. I
> did marshaled RequestSecurityToken, but it's purpose was to see xml
structure
> of the RequestSecurityToken that I build. Just checking with you in case I
> missed something.
> 
> 
> 
>         Body body = (Body)
>
bf.getBuilder(Body.DEFAULT_ELEMENT_NAME).buildObject(Body.DEFAULT_ELEMENT_NAM
> E);
>         
>         body.getUnknownXMLObjects().add(RequestSecurityToken);
>         envelope.setBody(body);
>         // SOAP context used by the SOAP client
>         BasicSOAPMessageContext soapContext = new
BasicSOAPMessageContext();
> 
>         soapContext.setOutboundMessage(envelope);
> 		
>         HttpClientBuilder clientBuilder = new HttpClientBuilder();
> 
>         HttpSOAPClient soapClient = new
> HttpSOAPClient(clientBuilder.buildClient(), parserPool);
>         
>         // Send the message
>         soapClient.send(serverEndpoint, soapContext);
> 



Yes, on first glance that looks correct.

I had to go and take a look at it b/c it's been a long time, but the
SOAP client does take care of marshalling and serializing the outbound
XMLObject, and deserializing and unmarshalling the response.  So you
don't generally need to marshall the SOAP Envelope that you are sending
before you invoke the client.  One exception would be if you were doing
anything with XML signatures - in that case you have to marshall first
before the actual signing operation, since the signature process
operates on the DOM level.