OpenSAML 3 into spring-security-saml

[Gherna, Andy]

I certainly understand and can get behind this response. I appreciate the pointer and I hope to make some constructive contribution to the community to solve this issue. Thank you for letting me know.

In the meantime, can you suggest any alternatives that would help our situation in the short term? For example, is there a way to assist in the development the examples you mentioned were not written yet?

Thanks again,

Andy Gherna
agherna at illinois.edu

> Date: Fri, 1 Sep 2017 16:38:04 +0000
From: "Cantor, Scott" <cantor.2 at osu.edu>
To: Shib Dev <dev at shibboleth.net>
Subject: Re: OpenSAML 3 into spring-security-saml
Message-ID: <B5FBDB5B-3472-4B77-8ACB-F07E4D37A6AB at osu.edu>
Content-Type: text/plain; charset="utf-8"

On 9/1/17, 12:17 PM, "dev on behalf of Gherna, Andy" <dev-bounces at shibboleth.net on behalf of agherna at illinois.edu> wrote:

> I have done some research on this and it is clear that simply changing the version of OpenSAML in spring-security-saml's pom file
> (or Gradle build file) is simply not enough to solve this problem. I commented in the issue [2] that this has been discussed and is
> unfortunately not easily resolved due to technical reasons (API changes in OpenSAML 3) and a perceived lack of API
> documentation in OpenSAML 3. Is there some API documentation that was simply overlooked by the spring-security-saml team?

We have plenty of API documentation, every class has decent javadocs. What we don't have is conceptual material and examples.

There's a book produced by an independent party that I think was updated to include V3 as a topic.

But this project is Shibboleth, not OpenSAML. Our goal and the requirements of our funders is the support of Shibboleth, which has its own backlog of documentation needs. OpenSAML is a byproduct that has always been a "take it or leave it" proposition. An effort to further document OpenSAML would require that one of the Consortium Members request that the project invest in that work and probably require pay to play funding to make it happen given existing commitments.

-- Scott