OpenSAML 3 into spring-security-saml

[Gherna, Andy]

Hello shib-dev,

We are looking to make use of spring-security-saml in our Java web applications as we transition our services to AWS with the goal of running our applications without Apache HTTPD (and mod_shib) as well as running our SPs in Docker. However, it's noted that spring-security-saml has a number of documented vulnerabilities and this can be ascribed to the fact that it is currently built on top of an old version of OpenSAML. A recently open issue [1] has outlined this and the discussion is based on resolving these vulnerabilities by upgrading OpenSAML which would bring the transitive dependencies along as mentioned.

I have done some research on this and it is clear that simply changing the version of OpenSAML in spring-security-saml's pom file (or Gradle build file) is simply not enough to solve this problem. I commented in the issue [2] that this has been discussed and is unfortunately not easily resolved due to technical reasons (API changes in OpenSAML 3) and a perceived lack of API documentation in OpenSAML 3. Is there some API documentation that was simply overlooked by the spring-security-saml team?

I'm writing to this list for help, guidance, and to offer whatever assistance I can to you to help get the spring-security-saml project what they need. If OpenSAML 3 can be applied to spring-security-saml, our security team would let us move forward with using it in our applications not to mention the benefits to both ecosystems. What can we do together to help close this gap?

[1] - https://github.com/spring-projects/spring-security-saml/issues/203

[2] - https://github.com/spring-projects/spring-security-saml/issues/203#issuecomment-319203239

Thanks,

Andy Gherna
agherna at illinois.edu