Sending SOAP messages in OpenSAML v3

[Brent Putman]

On 5/8/16 3:42 PM, Stefan Rasmusson wrote:
> Ok, so what would be the correct way of using the handlers?

At this point I'm not clear what you're asking. Maybe you can clarify
with a concrete example?

The thread started out as how to use the SOAP client, which is a
client-side question.  Later you asked "how can I use
the MessageLifetimeSecurityHandler with
the HTTPRedirectDeflateDecoder".  The latter decoder impl is only for
server-side.    You can't use the HTTPRedirectDeflateDecoder on a SOAP
client (or any client period), it's used on the server-side when
processing an inbound HttpServletRequest using that binding.


> Should there be a client implementation using the
> HttpServletMessagePipeline?

There can't be one, that literally doesn't make any sense. 
HttpServletMessagePipeline is by definition for the server-side. A SOAP
client doesn't have an HttpServletRequest/-Response.

(Unless by "client" you mean perhaps an SP sending an AuthnRequest,
etc.  I wouldn't really call that "client", but it is appropriate to
use server-side components there on an SP of course.  The
HttpServletMessagePipeline probably isn't appropriate there though,
since the SP case is like a "half-duplex" case, unlike the IdP case.)


> Or is it just as well to call the handlers straight on? I want to
> understand how the different components stick together.


Well, *something* has to call the handlers.  In the pipeline SOAP
client, that code itself orchestrates the whole pipeline by invoking
the encoder, decoder and handlers in the proper sequence.

For server-side, the order of operations is reversed from the
client-side.  And because of the nature of the server-side environment,
we can't really ship some single component which actually invokes
everything, since all the important details are really specific to the
server's environment/framework.  It's up to your server-side components
to do that.

The main point I have been trying to make is that: most of the
handlers, like the signature signing and validation ones, can be used
either with the SOAP client or for server-side (IdP/SP).  That's
because they operate on the logical message as represented by a
MessageContext, and don't care where the message data came from.

The main difference between the client and server cases is that you
need different auxiliary handlers to populate certain context data that
is used as input by the other handlers, like the signature ones.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20160509/3173699e/attachment.html>