which opensaml packages process metadata?

[Brent Putman]

On 9/26/17 12:15 PM, Jeff Ramin wrote:
>
> I'm attempting to modify an existing application (via the use of
> opensaml 3.0) to support SSO/SLO. The existing app will be a service
> provider.
>

I will channel Scott and say that you really ought to do yourself a
favor and at least consider using a pre-existing SAML SP implementation,
if possible.  Doing an SP properly is a *lot* of work and requires a
great deal of subject matter domain expertise.  Many implementations
that one sees out there done by primarily application developers with
little to no specific SAML expertise turn out to be absolutely horrible
- and often broken in a security vulnerability sense.  I'm not saying
that's necessarily you... but presumably everybody thinks they are going
to do it right when they start....

If you can front-end (reverse proxy) your Java app/container with a web
server like Apache httpd or IIS (a few other more esoteric options
exist, although maybe not applicable to Java apps), then you might
consider using the Shibboleth SP.  (For what it's worth, I'm the
OpenSAML Java lead and that is what I do for my own Java web
applications in my local university non-Shibboleth project work).  If
not, there are possibly a few other options for Java, like Spring
Security SAML (although I understand it's pretty out-of-date at the moment).

> My question - which package(s) in the opensaml library can be used to
> consume/process IDP metadata?  

Well, most/all the higher-level components which literally directly
parse metadata and produce a Java XMLObject model from it, and allow
resolution of EntityDescriptor(s) based on various criteria, are under
org.opensaml.saml.metadata, in Maven modules opensaml-saml-api and
opensaml-saml-impl.  In particular I'm talking about the various
MetadataResolver implementations.  The object model classes themselves
are under org.opensaml.saml.saml2.metadata in the same modules.

However, there are probably many other packages and classes which are
used more indirectly in the processing of metadata, and the
features/functionality derived from or dependent on it.  Too many for me
to easily enumerate.  OpenSAML and Shibboleth IdP pretty much assume the
use of SAML metadata everywhere, so it's pretty ubiquitous throughout
the library.  You'd have to ask a more specific question. 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20170927/eaa30306/attachment.html>