New here - OpenSAML and conditions/audience restrictions problem

[o haya]

Now that I got my test app to the point that it is kind of working, I have been looking at using OpenSAML 3.4 instead of 2.6.6.

Should I be able to just build the same Java app, using the opensaml 3.4 jar from nexus repo (https://build.shibboleth.net/nexus/content/repositories/releases/org/opensaml/)?  I would prefer to do that rather than using Maven, if possible.

Thanks,
Jim



--------------------------------------------
On Fri, 2/15/19, o haya <ohaya at yahoo.com> wrote:

 Subject: Re: New here - OpenSAML and conditions/audience restrictions problem
 To: "Shib Dev" <dev at shibboleth.net>
 Cc: "ohaya at yahoo.com" <ohaya at yahoo.com>
 Date: Friday, February 15, 2019, 4:09 PM
 
 
         Hi,
 I was
 able to get it to work now.  I had to add back (uncomment)
 the lines where the conditions and condition were
 created.
 Thanks!
 Jim
 P.S.  BTW, and yes, I will look
 into moving to a newer version of OpenSAML, but I ran into
 some problems trying to use the newer one before, but I
 wanted to try to get something working first.
 
 
 
 
         
         
             
                 
                 
                     On Friday, February 15, 2019, 3:42:11 PM
 EST, o haya <ohaya at yahoo.com> wrote:
                 
                 
 
                 
 
                 Hi,
 
 Thanks, maybe I am
 mis-reading what you were suggesting (the formatting on
 Yahoo email may be bad), but if I remove the parts that you
 mentioned:
 
 ====================================================================================================================================
 
 >
 > The part of my code
 that is building that is:
 >
 > 
            SAMLObjectBuilder
 audienceRestrictionConditionBuilder = (SAMLObjectBuilder)
 SAMLWriter.getSAMLBuilder().getBuilder(AudienceRestriction.DEFAULT_ELEMENT_NAME);
 >            
 Condition condition = (Condition)
 audienceRestrictionConditionBuilder.buildObject();
 
 
 Here you are building the
 empty one ...
 
 
 >
 >            
 SAMLObjectBuilder conditionsBuilder = (SAMLObjectBuilder)
 SAMLWriter.getSAMLBuilder().getBuilder(Conditions.DEFAULT_ELEMENT_NAME);
 >            
 Conditions conditions = (Conditions)
 conditionsBuilder.buildObject();
 >            
 conditions.getConditions().add(condition);
 
 
 ... and here you are
 adding the empty one to the Conditions.  You don't need
 to do this, or the above.
 
 ====================================================================================================================================
 
 both
 "conditions" and "condition" are
 undefined?
 
 
 Like I said, I may be
 mis-reading/misunderstanding what you were suggesting, but I
 think that this is what I got when I commented out the lines
 you mentioned:
 
 
            
 conditions.setNotBefore(now);
            
 conditions.setNotOnOrAfter(now2);
             
             SAMLObjectBuilder
 audienceRestrictionnBuilder = null;
            
 SAMLObjectBuilder audienceBuilder = null;
            
 audienceRestrictionnBuilder = (SAMLObjectBuilder)
 getSAMLBuilder().getBuilder(AudienceRestriction.DEFAULT_ELEMENT_NAME);
            
 audienceBuilder = (SAMLObjectBuilder)
 getSAMLBuilder().getBuilder(Audience.DEFAULT_ELEMENT_NAME);
             String
 audienceURI = "https://sandboxdtm01.xxx.dev/fed";
             
             //
 Create the audience
  
           Audience audience = (Audience)
 audienceBuilder.buildObject();
            
 audience.setAudienceURI(audienceURI);
 
             //
 Create the audience restriction
             AudienceRestriction
 audienceRestriction = (AudienceRestriction)
 audienceRestrictionnBuilder.buildObject();
 
             // add
 in the audience
    
        
 audienceRestriction.getAudiences().add(audience);
            
 conditions.getAudienceRestrictions().add(audienceRestriction);
             
 
 Jim
 
 
 
 
 
 
 
 --------------------------------------------
 On Fri, 2/15/19, Brent
 Putman <putmanb at georgetown.edu>
 wrote:
 
  Subject: Re: New here -
 OpenSAML and conditions/audience restrictions problem
  To: dev at shibboleth.net
  Date: Friday, February
 15, 2019, 3:10 PM
  
  
      
  
      
      On 2/15/19
  2:55 PM, o haya wrote:
  
      
      
        
  
  I am just getting started
 with OpenSAML, and using Java and
  OpenSAML 2.6.6 
      
    
  
  
      
      Don't.  Use
 the latest 3.x  OpenSAML 2.x has
  been End Of Life for
        over 2.5 years at this point. See the
 announcement and
  links
 here:
      https://wiki.shibboleth.net/confluence/display/OpenSAML/Home
  
      
       There's
 absolutely no reason to start a new
  project with 2.x,
        and it is indeed
 a bad idea due to security
  vulnerabilities which
        have been fixed since it went EOL.
  
      
      
  
      
      
        
  
  I have code now that, in
 fact does add the
 
 <Conditions>, but I am ending up with two
 
 <saml:AudienceRestriction> elements. 
      
      
  
      
      Yes, you are adding
 it twice.
      
  
      
      
        
  whereas I think that what
 I want is (i.e., just the one
  saml2:AudienceRestriction with the URI):
  
  <saml2:Conditions
 
 NotOnOrAfter="2019-02-15T19:27:56.620Z"
 
 NotBefore="2019-02-15T19:27:56.603Z">
     
 <saml2:AudienceRestriction>
          <saml2:Audience>https://sandboxdtm01.xxx.dev/fed</saml2:Audience>
     
 </saml2:AudienceRestriction>
 
 </saml2:Conditions>
  
      
      
  
      
      Correct. An empty
 AudienceRestriction would not make
  any sense.
        It might even be
 schema-invalid, I'd have to
  check.
  
      
      
  
      
      
        
  The part of my code that
 is building that is:
 
 
             
 SAMLObjectBuilder
 
 audienceRestrictionConditionBuilder = (SAMLObjectBuilder)
 
 SAMLWriter.getSAMLBuilder().getBuilder(AudienceRestriction.DEFAULT_ELEMENT_NAME);
             
 Condition condition = (Condition)
 
 audienceRestrictionConditionBuilder.buildObject();
      
      
  
      
      Here you are
 building the empty one ...
      
  
      
      
        
  
             
 SAMLObjectBuilder conditionsBuilder =
  (SAMLObjectBuilder)
 
 SAMLWriter.getSAMLBuilder().getBuilder(Conditions.DEFAULT_ELEMENT_NAME);
             
 Conditions conditions = (Conditions)
 
 conditionsBuilder.buildObject();
             
 conditions.getConditions().add(condition);
      
      
  
      
      ... and here you
 are adding the empty one to the
  Conditions.  You
        don't need to do this, or the
 above.
      
  
      
      
        
              //
 Create the audience restriction
              AudienceRestriction
 audienceRestriction =
 
 (AudienceRestriction)
 
 audienceRestrictionnBuilder.buildObject();
  
              // add
 in the audience
    
         
 audienceRestriction.getAudiences().add(audience);
         
     
 conditions.getAudienceRestrictions().add(audienceRestriction);
      
      
  
      
      And here you are
 adding the non-empty one, which is
  the code to
        keep.
      
  
      
      
  
      
      
        
  
  It seems like just
 instantiating the builder is making the
  empty
 saml2:AudienceRestriction, but I don't know how to
  make an "empty"
 builder?
      
      
  
      
      No, that's not
 correct. Instantiating a builder
  does not make
        anything (other than the builder of
 course).  Calling
  one
 of the
       
 build(...) methods is what makes the SAMLObject.  So
  there's no
        such thing as an
 "empty" builder.
  
      
      
  
    -- 
  To unsubscribe from this
 list send an email to
 
 dev-unsubscribe at shibboleth.net
  -----Inline Attachment
 Follows-----