Sending SOAP messages in OpenSAML v3

[Brent Putman]

On 4/30/16 11:00 AM, Stefan Rasmusson wrote:
> I love the new handlers,

Excellent! The intent is that the message processing model for
server-side and client-side is the same, So you can use many/most of
the same handlers for both, for example for SAML message processing.

> Im using SAMLOutboundProtocolMessageSigningHandler to sign SOAP. Is
> there anyone for validating on the other side? I could not find a
> obvious candidate.

Absolutely.  SAMLProtocolMessageXMLSignatureSecurityHandler.  In the
same package.

There's probably a slight bit of more work to do there, as many of the
inbound handlers like this one would require things to be populated in
the inbound MessageContext, like a SignatureValidationParameters with a
TrustEngine, etc.  That sort of thing is likely a bit different on the
server- vs client-side, because of the environmental differences, and
is one of the things I'm working on right now.  The existing
server-side code is implemented as a ProfileAction processing a
ProfileRequestContext, which doesn't work for the SOAP client case.


>
> The validateJCEProviders and validateNonSunJAXP, are they gone?
>

The former is still there.  It's an Initializer impl,
org.opensaml.xmlsec.config.JavaCryptoValidationInitializer.

The latter is consciously removed in v3, since we no longer require use
of a non-Sun JAXP (e.g. an endorsed Xerces).  The only reason for that
was that older versions of Sun/Oracle Java shipped with a buggy Xerces
embedded.  That's not the case anymore, as far as we  know.


> Also I couldn't seem to find the AbstractPipelineHttpSOAPClient in
> the 3.1.1 version so I using the 3.3.0-SNAPSHOT.

All the new SOAP client stuff was released in 3.2.0, so you could use
that rather than the SNAPSHOT.


> What is the ETA on releasing 3.3.0?


I don't think we have an exact date yet, but it's still a few months
away.  Roughly sometime in the fall.



-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20160430/d9a8df66/attachment.html>