SOAP Client - Key and Trust Managers

[Vasu Y]

Thanks for the Java SOAP Client example (https://wiki.shibboleth.net/confluence/display/OpenSAML/OSTwoUserManJavaSOAPClientExample), i was able to successfully send LogoutRequest from Service Provider (that i am writing) to IDP through the back-channel and get a successful LogoutResponse.


If only the client (SP) is making/initiating the SOAP call (or any Back-channel call) to IDP, and the SP doesn't support IDP making SOAP calls (any Back-channel), then does SP need to specify X509TrustManager to the TLSProtocolSocketFactory? I was able to get this working by passing null for X509TrustManager.

HttpClientBuilder clientBuilder = new HttpClientBuilder();
clientBuilder.setHttpsProtocolSocketFactory(
new TLSProtocolSocketFactory(new MyX509ExtendedKeyManager(spSigningCred.getPrivateKey(), spSigningCred.getEntityCertificate()), null));
And for the key manager, i used the SP's signing key credentials and it worked fine with Shibboleth2 IDP. Is it accepted by SAML standard to use KeyManager based on SP's signing key in the TLSProtocolSocketFactory  ?
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/dev/attachments/20140421/bb22dfbc/attachment.html