OpenSAML3 state

[Cantor, Scott]

On 5/8/15, 6:17 AM, "Martin Haase" <Martin.Haase at DAASI.de> wrote:

>Hi team great,
>
>I have two questions regarding OpenSAML-java:
>
>1) https://wiki.shibboleth.net/confluence/display/DEV/Project+Roadmap
>has an EOL for OS2 in July 2016, like the IdP2. Is this still current state?

http://shibboleth.net/community/news/20150505.html

>2) Given its release date, OpenSAML3 seems to be primarily for use by
>IdP3.

Speaking for myself, OpenSAML has only and ever been a by-product of Shibboleth, made for the use of Shibboleth, and there have been no resources available to turn it into anything more. It is made available as is for anybody that wants to use it, but only as a side effect. That isn't a change to me, in other words. I've been publically saying that consistently for 15 years now.

> How about any functionality an SP might need?

There is at least as much, if not more, code relevant to an SP now than there was before. I think there's quite a bit more in fact, and more coming (like a proper SOAP client). So, again, not a change at all.

>I'm asking this in the background of using OS3 in Spring-Security-SAML2,
>and when it could be sensibly expected to be available there. I'm afraid
>the time frame for the Spring folks and any developers relying on spring
>security might be a somewhat narrow, given that OS3 documentation in the
>Wiki is still not complete.

If I were to guess, it never will be, certainly not soon. That's what "produced as a side effect of Shbboleth" means. That's what it has always meant; no investment by the funders into the library to make it a stand alone deliverable, since libraries need good documentation to be worthwhile.

> What about extending the OS2 EOL?

If we extended it, it would be because of push back on the EOL for Shibboleth, not because of OpenSAML itself. That's a Board decision, but not one that the developers would likely be very happy with given the limited resources we have, and again speaking for myself, I would not take into account the OpenSAML part specifically in that decision, particularly if they're not funding the Shibboleth Project.

-- Scott