New here - OpenSAML and conditions/audience restrictions problem

[Brent Putman]

On 2/15/19 2:55 PM, o haya wrote:
>
> I am just getting started with OpenSAML, and using Java and OpenSAML 2.6.6 


Don't.  Use the latest 3.x  OpenSAML 2.x has been End Of Life for over
2.5 years at this point. See the announcement and links here:

https://wiki.shibboleth.net/confluence/display/OpenSAML/Home

There's absolutely no reason to start a new project with 2.x, and it is
indeed a bad idea due to security vulnerabilities which have been fixed
since it went EOL.


>
> I have code now that, in fact does add the <Conditions>, but I am ending up with two <saml:AudienceRestriction> elements. 


Yes, you are adding it twice.


> whereas I think that what I want is (i.e., just the one saml2:AudienceRestriction with the URI):
>
> <saml2:Conditions NotOnOrAfter="2019-02-15T19:27:56.620Z" NotBefore="2019-02-15T19:27:56.603Z">
>     <saml2:AudienceRestriction>
>         <saml2:Audience>https://sandboxdtm01.xxx.dev/fed</saml2:Audience>
>     </saml2:AudienceRestriction>
> </saml2:Conditions>


Correct. An empty AudienceRestriction would not make any sense. It
might even be schema-invalid, I'd have to check.


> The part of my code that is building that is:
>
>             SAMLObjectBuilder audienceRestrictionConditionBuilder = (SAMLObjectBuilder) SAMLWriter.getSAMLBuilder().getBuilder(AudienceRestriction.DEFAULT_ELEMENT_NAME);
>             Condition condition = (Condition) audienceRestrictionConditionBuilder.buildObject();


Here you are building the empty one ...


>
>             SAMLObjectBuilder conditionsBuilder = (SAMLObjectBuilder) SAMLWriter.getSAMLBuilder().getBuilder(Conditions.DEFAULT_ELEMENT_NAME);
>             Conditions conditions = (Conditions) conditionsBuilder.buildObject();
>             conditions.getConditions().add(condition);


... and here you are adding the empty one to the Conditions.  You don't
need to do this, or the above.


>         	// Create the audience restriction
>         	AudienceRestriction audienceRestriction = (AudienceRestriction) audienceRestrictionnBuilder.buildObject();
>
>         	// add in the audience
>         	audienceRestriction.getAudiences().add(audience);
>         	conditions.getAudienceRestrictions().add(audienceRestriction);


And here you are adding the non-empty one, which is the code to keep.



>
> It seems like just instantiating the builder is making the empty saml2:AudienceRestriction, but I don't know how to make an "empty" builder?


No, that's not correct. Instantiating a builder does not make anything
(other than the builder of course).  Calling one of the build(...)
methods is what makes the SAMLObject.  So there's no such thing as an
"empty" builder.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20190215/1162ea83/attachment.html>