Status of HTTPArtifactDecoder

[Cantor, Scott]

On 8/25/14, 12:12 PM, "Marvin Addison" <marvin.addison at gmail.com> wrote:

>I was looking into HTTPArtifactDecoder for a component to help with
>implementing the SAML 1.1 support in CAS. I was a little surprised
>that it's not implemented, but figured it was just down on the TODO
>list. I was outright startled when I looked at the v2 codebase and
>found it bore the same javadoc note as the v3 component:
>
><strong>NOTE: This decoder is not yet implemented.</strong>
>
>Does that mean browser/artifact profile is not supported in v2 at present?

The Decoder is for handling the artifact binding as an inbound binding,
meaning the SP sends the artifact, and the IdP calls back to the SP with
SOAP. There aren't really use cases for that binding, it's just a symmetry
that falls out of the design of the standard. We never implemented a fully
working SOAP client in the IdP, so that among other reasons is why it's
not in V2 and hasn't been done yet for V3.

Artifact support outbound from the IdP is implemented in both stacks, but
that's not done with an ArtifactDecoder. The artifact is generated with
the ArtifactEncoder, and the resolution of the artifact by the IdP happens
in a profile flow for that purpose, and that uses the SOAP binding.

-- Scott