New here - OpenSAML and conditions/audience restrictions problem

[Brent Putman]

Ok.  I didn't literally mean remove those exact lines.  I meant remove
what those are doing re adding the redundant empty AR.  Obviously you
still need the Conditions element, etc.


On 2/15/19 4:09 PM, o haya wrote:
> Hi,
>
> I was able to get it to work now.  I had to add back (uncomment) the
> lines where the conditions and condition were created.
>
> Thanks!
>
> Jim
>
> P.S.  BTW, and yes, I will look into moving to a newer version of
> OpenSAML, but I ran into some problems trying to use the newer one
> before, but I wanted to try to get something working first.
>
>
>
>
> On Friday, February 15, 2019, 3:42:11 PM EST, o haya
> <ohaya at yahoo.com> wrote:
>
>
> Hi,
>
> Thanks, maybe I am mis-reading what you were suggesting (the
> formatting on Yahoo email may be bad), but if I remove the parts that
> you mentioned:
>
> ====================================================================================================================================
>
> >
> > The part of my code that is building that is:
> >
> >            SAMLObjectBuilder audienceRestrictionConditionBuilder =
> (SAMLObjectBuilder)
> SAMLWriter.getSAMLBuilder().getBuilder(AudienceRestriction.DEFAULT_ELEMENT_NAME);
> >            Condition condition = (Condition)
> audienceRestrictionConditionBuilder.buildObject();
>
>
> Here you are building the empty one ...
>
>
> >
> >            SAMLObjectBuilder conditionsBuilder =
> (SAMLObjectBuilder)
> SAMLWriter.getSAMLBuilder().getBuilder(Conditions.DEFAULT_ELEMENT_NAME);
> >            Conditions conditions = (Conditions)
> conditionsBuilder.buildObject();
> >            conditions.getConditions().add(condition);
>
>
> ... and here you are adding the empty one to the Conditions.  You
> don't need to do this, or the above.
>
> ====================================================================================================================================
>
> both "conditions" and "condition" are undefined?
>
>
> Like I said, I may be mis-reading/misunderstanding what you were
> suggesting, but I think that this is what I got when I commented out
> the lines you mentioned:
>
>
>             conditions.setNotBefore(now);
>             conditions.setNotOnOrAfter(now2);
>            
>             SAMLObjectBuilder audienceRestrictionnBuilder = null;
>             SAMLObjectBuilder audienceBuilder = null;
>             audienceRestrictionnBuilder = (SAMLObjectBuilder)
> getSAMLBuilder().getBuilder(AudienceRestriction.DEFAULT_ELEMENT_NAME);
>             audienceBuilder = (SAMLObjectBuilder)
> getSAMLBuilder().getBuilder(Audience.DEFAULT_ELEMENT_NAME);
>             String audienceURI = "https://sandboxdtm01.xxx.dev/fed";
>            
>             // Create the audience
>             Audience audience = (Audience) audienceBuilder.buildObject();
>             audience.setAudienceURI(audienceURI);
>
>             // Create the audience restriction
>             AudienceRestriction audienceRestriction =
> (AudienceRestriction) audienceRestrictionnBuilder.buildObject();
>
>             // add in the audience
>             audienceRestriction.getAudiences().add(audience);
>            
> conditions.getAudienceRestrictions().add(audienceRestriction);
>            
>
> Jim
>
>
>
>
>
>
>
> --------------------------------------------
> On Fri, 2/15/19, Brent Putman <putmanb at georgetown.edu
> <mailto:putmanb at georgetown.edu>> wrote:
>
> Subject: Re: New here - OpenSAML and conditions/audience restrictions
> problem
> To: dev at shibboleth.net <mailto:dev at shibboleth.net>
> Date: Friday, February 15, 2019, 3:10 PM
>
>
>    
>
>    
>     On 2/15/19
> 2:55 PM, o haya wrote:
>
>    
>    
>      
>
> I am just getting started with OpenSAML, and using Java and
> OpenSAML 2.6.6
>    
>    
>
>    
>     Don't.  Use the latest 3.x  OpenSAML 2.x has
> been End Of Life for
>       over 2.5 years at this point. See the announcement and
> links here:
>     https://wiki.shibboleth.net/confluence/display/OpenSAML/Home
>
>    
>       There's absolutely no reason to start a new
> project with 2.x,
>       and it is indeed a bad idea due to security
> vulnerabilities which
>       have been fixed since it went EOL.
>
>    
>    
>
>    
>    
>      
>
> I have code now that, in fact does add the
> <Conditions>, but I am ending up with two
> <saml:AudienceRestriction> elements.
>    
>    
>
>    
>     Yes, you are adding it twice.
>    
>
>    
>    
>      
> whereas I think that what I want is (i.e., just the one
> saml2:AudienceRestriction with the URI):
>
> <saml2:Conditions
> NotOnOrAfter="2019-02-15T19:27:56.620Z"
> NotBefore="2019-02-15T19:27:56.603Z">
>     <saml2:AudienceRestriction>
>         <saml2:Audience>https://sandboxdtm01.xxx.dev/fed</saml2:Audience>
>     </saml2:AudienceRestriction>
> </saml2:Conditions>
>
>    
>    
>
>    
>     Correct. An empty AudienceRestriction would not make
> any sense.
>       It might even be schema-invalid, I'd have to
> check.
>
>    
>    
>
>    
>    
>      
> The part of my code that is building that is:
>
>             SAMLObjectBuilder
> audienceRestrictionConditionBuilder = (SAMLObjectBuilder)
> SAMLWriter.getSAMLBuilder().getBuilder(AudienceRestriction.DEFAULT_ELEMENT_NAME);
>             Condition condition = (Condition)
> audienceRestrictionConditionBuilder.buildObject();
>    
>    
>
>    
>     Here you are building the empty one ...
>    
>
>    
>    
>      
>
>             SAMLObjectBuilder conditionsBuilder =
> (SAMLObjectBuilder)
> SAMLWriter.getSAMLBuilder().getBuilder(Conditions.DEFAULT_ELEMENT_NAME);
>             Conditions conditions = (Conditions)
> conditionsBuilder.buildObject();
>             conditions.getConditions().add(condition);
>    
>    
>
>    
>     ... and here you are adding the empty one to the
> Conditions.  You
>       don't need to do this, or the above.
>    
>
>    
>    
>      
>             // Create the audience restriction
>             AudienceRestriction audienceRestriction =
> (AudienceRestriction)
> audienceRestrictionnBuilder.buildObject();
>
>             // add in the audience
>             audienceRestriction.getAudiences().add(audience);
>        
>     conditions.getAudienceRestrictions().add(audienceRestriction);
>    
>    
>
>    
>     And here you are adding the non-empty one, which is
> the code to
>       keep.
>    
>
>    
>    
>
>    
>    
>      
>
> It seems like just instantiating the builder is making the
> empty saml2:AudienceRestriction, but I don't know how to
> make an "empty" builder?
>    
>    
>
>    
>     No, that's not correct. Instantiating a builder
> does not make
>       anything (other than the builder of course).  Calling
> one of the
>       build(...) methods is what makes the SAMLObject.  So
> there's no
>       such thing as an "empty" builder.
>
>    
>    
>
>   --
> To unsubscribe from this list send an email to
> dev-unsubscribe at shibboleth.net <mailto:dev-unsubscribe at shibboleth.net>
> -----Inline Attachment Follows-----
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20190215/38247815/attachment-0001.html>