New here - OpenSAML and conditions/audience restrictions problem

[o haya]

 Hi,
I was able to get it to work now.  I had to add back (uncomment) the lines where the conditions and condition were created.
Thanks!
Jim
P.S.  BTW, and yes, I will look into moving to a newer version of OpenSAML, but I ran into some problems trying to use the newer one before, but I wanted to try to get something working first.



    On Friday, February 15, 2019, 3:42:11 PM EST, o haya <ohaya at yahoo.com> wrote:  
 
 Hi,

Thanks, maybe I am mis-reading what you were suggesting (the formatting on Yahoo email may be bad), but if I remove the parts that you mentioned:

====================================================================================================================================

>
> The part of my code that is building that is:
>
>            SAMLObjectBuilder audienceRestrictionConditionBuilder = (SAMLObjectBuilder) SAMLWriter.getSAMLBuilder().getBuilder(AudienceRestriction.DEFAULT_ELEMENT_NAME);
>            Condition condition = (Condition) audienceRestrictionConditionBuilder.buildObject();


Here you are building the empty one ...


>
>            SAMLObjectBuilder conditionsBuilder = (SAMLObjectBuilder) SAMLWriter.getSAMLBuilder().getBuilder(Conditions.DEFAULT_ELEMENT_NAME);
>            Conditions conditions = (Conditions) conditionsBuilder.buildObject();
>            conditions.getConditions().add(condition);


... and here you are adding the empty one to the Conditions.  You don't need to do this, or the above.

====================================================================================================================================

both "conditions" and "condition" are undefined?


Like I said, I may be mis-reading/misunderstanding what you were suggesting, but I think that this is what I got when I commented out the lines you mentioned:


            conditions.setNotBefore(now);
            conditions.setNotOnOrAfter(now2);
            
            SAMLObjectBuilder audienceRestrictionnBuilder = null;
            SAMLObjectBuilder audienceBuilder = null;
            audienceRestrictionnBuilder = (SAMLObjectBuilder) getSAMLBuilder().getBuilder(AudienceRestriction.DEFAULT_ELEMENT_NAME);
            audienceBuilder = (SAMLObjectBuilder) getSAMLBuilder().getBuilder(Audience.DEFAULT_ELEMENT_NAME);
            String audienceURI = "https://sandboxdtm01.xxx.dev/fed";
            
            // Create the audience
            Audience audience = (Audience) audienceBuilder.buildObject();
            audience.setAudienceURI(audienceURI);

            // Create the audience restriction
            AudienceRestriction audienceRestriction = (AudienceRestriction) audienceRestrictionnBuilder.buildObject();

            // add in the audience
            audienceRestriction.getAudiences().add(audience);
            conditions.getAudienceRestrictions().add(audienceRestriction);
            

Jim







--------------------------------------------
On Fri, 2/15/19, Brent Putman <putmanb at georgetown.edu> wrote:

 Subject: Re: New here - OpenSAML and conditions/audience restrictions problem
 To: dev at shibboleth.net
 Date: Friday, February 15, 2019, 3:10 PM
 
 
    
 
    
    On 2/15/19
 2:55 PM, o haya wrote:
 
    
    
      
 
 I am just getting started with OpenSAML, and using Java and
 OpenSAML 2.6.6 
    
    
 
    
    Don't.  Use the latest 3.x  OpenSAML 2.x has
 been End Of Life for
      over 2.5 years at this point. See the announcement and
 links here:
    https://wiki.shibboleth.net/confluence/display/OpenSAML/Home
 
    
      There's absolutely no reason to start a new
 project with 2.x,
      and it is indeed a bad idea due to security
 vulnerabilities which
      have been fixed since it went EOL.
 
    
    
 
    
    
      
 
 I have code now that, in fact does add the
 <Conditions>, but I am ending up with two
 <saml:AudienceRestriction> elements. 
    
    
 
    
    Yes, you are adding it twice.
    
 
    
    
      
 whereas I think that what I want is (i.e., just the one
 saml2:AudienceRestriction with the URI):
 
 <saml2:Conditions
 NotOnOrAfter="2019-02-15T19:27:56.620Z"
 NotBefore="2019-02-15T19:27:56.603Z">
    <saml2:AudienceRestriction>
        <saml2:Audience>https://sandboxdtm01.xxx.dev/fed</saml2:Audience>
    </saml2:AudienceRestriction>
 </saml2:Conditions>
 
    
    
 
    
    Correct. An empty AudienceRestriction would not make
 any sense.
      It might even be schema-invalid, I'd have to
 check.
 
    
    
 
    
    
      
 The part of my code that is building that is:
 
            SAMLObjectBuilder
 audienceRestrictionConditionBuilder = (SAMLObjectBuilder)
 SAMLWriter.getSAMLBuilder().getBuilder(AudienceRestriction.DEFAULT_ELEMENT_NAME);
            Condition condition = (Condition)
 audienceRestrictionConditionBuilder.buildObject();
    
    
 
    
    Here you are building the empty one ...
    
 
    
    
      
 
            SAMLObjectBuilder conditionsBuilder =
 (SAMLObjectBuilder)
 SAMLWriter.getSAMLBuilder().getBuilder(Conditions.DEFAULT_ELEMENT_NAME);
            Conditions conditions = (Conditions)
 conditionsBuilder.buildObject();
            conditions.getConditions().add(condition);
    
    
 
    
    ... and here you are adding the empty one to the
 Conditions.  You
      don't need to do this, or the above.
    
 
    
    
      
            // Create the audience restriction
            AudienceRestriction audienceRestriction =
 (AudienceRestriction)
 audienceRestrictionnBuilder.buildObject();
 
            // add in the audience
            audienceRestriction.getAudiences().add(audience);
        
     conditions.getAudienceRestrictions().add(audienceRestriction);
    
    
 
    
    And here you are adding the non-empty one, which is
 the code to
      keep.
    
 
    
    
 
    
    
      
 
 It seems like just instantiating the builder is making the
 empty saml2:AudienceRestriction, but I don't know how to
 make an "empty" builder?
    
    
 
    
    No, that's not correct. Instantiating a builder
 does not make
      anything (other than the builder of course).  Calling
 one of the
      build(...) methods is what makes the SAMLObject.  So
 there's no
      such thing as an "empty" builder.
 
    
    
 
  -- 
 To unsubscribe from this list send an email to
 dev-unsubscribe at shibboleth.net
 -----Inline Attachment Follows-----
 
   
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20190215/b8f0abdc/attachment-0001.html>