Problems trying to migrate/build using OpenSAML3 (3.3.0) with Eclipse and Maven

Mon Feb 25 16:36:47 EST 2019

Hi,

I think that I've made some (a little) progress.  I am now able to do the assertion.setSignature(signature) without the app blowing up, BUT:

- in order to do that, I had to add xmltooling 1.4.4 to the dependencies (see below) and
- I end up with only the Assertion with the <ds:Signature> in it, but that is mostly just the shell of the <ds:Signature> e.g., <ds:DigestValue> is empty, etc.) and
- When the Sign.signObject(signature) is executed after that, it doesn't thrown an error, but then when I try to marshall the Assertion after that, I get a NullPointer

I am kind of puzzled about needing the xmltooling, because I have seen some postings that seem to indicate that, with OpenSAML V3, I should not need xmltooling?

However, I could not get the app to compile without the xmltooling dependency because of using references to "Configuration" and "SecurityConfiguration".  

Perhaps there are supposed to be something to substitute for those in OpenSAML V3?

Here's what I end up with so far for the Assertion:

<saml2:Assertion ID="id-_7e312308ca150f5bc67c8dd38aee04f9"
    IssueInstant="2019-02-25T21:02:03.936Z" Version="2.0"
    xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xsd="http://www.w3.org/2001/XMLSchema">
    <saml2:Issuer
        Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity" xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">https://sandboxdtm01.dev:14101/oam/fed</saml2:Issuer>
    <ds:Signature
                xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
<ds:SignedInfo>
<ds:CanonicalizationMethod
                Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
<ds:SignatureMethod
                Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
<ds:Reference
                        URI="#id-_7e312308ca150f5bc67c8dd38aee04f9">
<ds:Transforms>
<ds:Transform
                        Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
<ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#">
                        <ec:InclusiveNamespaces PrefixList="xsd" xmlns:ec="http://www.w3.org/2001/10/xml-exc-c14n#"/>
                    </ds:Transform>
</ds:Transforms>
<ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
<ds:DigestValue/>
</ds:Reference>
</ds:SignedInfo>
<ds:SignatureValue/>
</ds:Signature>
    <saml2:Subject xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">
        <saml2:NameID
            Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress" NameQualifier="My Website">jim at test.com</saml2:NameID>
        <saml2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
            <saml2:SubjectConfirmationData
                NotOnOrAfter="2019-02-25T21:04:03.936Z" Recipient="https://sandboxdtm01.dev/oam/server/fed/sp/sso"/>
        </saml2:SubjectConfirmation>
    </saml2:Subject>
    <saml2:Conditions NotBefore="2019-02-25T21:02:03.936Z"
        NotOnOrAfter="2019-02-25T21:07:03.936Z" xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">
        <saml2:AudienceRestriction>
            <saml2:Audience>https://sandboxdtm01.dev:14101/oam/fed</saml2:Audience>
        </saml2:AudienceRestriction>
    </saml2:Conditions>
    <saml2:AuthnStatement AuthnInstant="2019-02-25T21:02:03.963Z"
        SessionIndex="id-_068f30acf6fc4acabb5b0b7d763f5ed4"
        SessionNotOnOrAfter="2019-02-25T21:02:03.978Z" xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">
        <saml2:AuthnContext>
            <saml2:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml2:AuthnContextClassRef>
        </saml2:AuthnContext>
    </saml2:AuthnStatement>
    <saml2:AttributeStatement xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">
        <saml2:Attribute Name="uid">
            <saml2:AttributeValue
                xmlns:xsd="http://www.w3.org/2001/XMLSchema"
                xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xsd:string">jim at test.com</saml2:AttributeValue>
        </saml2:Attribute>
        <saml2:Attribute Name="FirstName">
            <saml2:AttributeValue
                xmlns:xsd="http://www.w3.org/2001/XMLSchema"
                xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xsd:string">John</saml2:AttributeValue>
        </saml2:Attribute>
        <saml2:Attribute Name="LastName">
            <saml2:AttributeValue
                xmlns:xsd="http://www.w3.org/2001/XMLSchema"
                xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xsd:string">Smith</saml2:AttributeValue>
        </saml2:Attribute>
        <saml2:Attribute Name="gxemailpref">
            <saml2:AttributeValue
                xmlns:xsd="http://www.w3.org/2001/XMLSchema"
                xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xsd:string">jim at test.com</saml2:AttributeValue>
        </saml2:Attribute>
    </saml2:AttributeStatement>
</saml2:Assertion>

Thanks,
Jim

--------------------------------------------
On Mon, 2/25/19, o haya <ohaya at yahoo.com> wrote:

 Subject: Re: Problems trying to migrate/build using OpenSAML3 (3.3.0) with Eclipse and Maven
 To: "Shib Dev" <dev at shibboleth.net>
 Cc: ohaya at yahoo.com
 Date: Monday, February 25, 2019, 10:54 AM

 Brent,

 Can you explain what you mean by "For
 usage examples, the best thing is to look at the unit tests
 in the various projects."?  Where are the "various
 projects" that you were referring to?

 My apologies, but I am really
 struggling on the migration.  I have essentially been
 stuck at the point in the code where I have created an
 assertion (that part works) and am then trying to sign the
 assertion, and thus far, I am stuck there for several
 days.  If there are examples somewhere that show how to
 use OpenSAML V3 to sign an Assertion, given an Assertion,
 that would be really great!

 Thanks,
 Jim

 --------------------------------------------
 On Sat, 2/23/19, Brent Putman <putmanb at georgetown.edu>
 wrote:

  Subject: Re: Problems trying to
 migrate/build using OpenSAML3 (3.3.0) with Eclipse and
 Maven
  To: dev at shibboleth.net
  Date: Saturday, February 23, 2019,
 4:53 PM

      On 2/23/19
  12:59 PM, o haya wrote:

        Hi,

  I am trying to migrate the application
 that I had written (a
  modified version of SAMLWriter.java)
 earlier using OpenSAML
  2.6.6, now, to OpenSAML 3.3.0 using
 Eclipse and Maven.

      Well, as I said before
 you don't have to use
  Maven, nor Eclipse. 
        Use what you are
 comfortable with.

  I am not that familiar with Maven, but
 anyway, I added
  dependencies in the pom.xml:

      The use of
 dependencyManagement is a little overkill
  for a single
        project like
 this, but it's not wrong. I don't
  see any other
        obvious
 problems.

  But, when I do Run As ==> Maven
 Build ==> clean
  install -U, I am getting some errors
 that I haven't been
  able to resolve so far:

  - Configuration cannot be resolved

  - IdentifierGenerator cannot be
 resolved to a type

  - SecureRandomIdentifierGenerator
 cannot be resolved to a
  type

  - SecurityConfiguration cannot be
 resolved to a type

  - SecurityHelper cannot be resolved

  - The constructor
 BasicX509Credential() is undefined

  - XMLHelper cannot be resolved

      3.x is not 2.x.  At the
 very least all the package
  names changed,
        so any existing
 'import' statements are
  wrong.  In many cases the
        code itself was
 refactored or rewritten, so classes
  and methods
        don't exist
 anymore, or have different names, or

 method/constructor arguments are different, etc.
      Some of the "cannot be
 resolved" ones are
  likely simply package
        changes.  Some
 of those classes don't exist
  anymore however, like
        XMLHelper,
 SecurityHelper, they were replaced by other
  things.

      The Javadocs are your
 friend:
      https://wiki.shibboleth.net/confluence/display/OS30/APIDocumentation

      For usage examples, the
 best thing is to look at the
  unit tests
        in the various
 projects.

  For the BasicX509Credential() error,
 this is the line that
  it is flagging in my code:

           BasicX509Credential
  credential = new
 BasicX509Credential();

      IIRC there is no longer
 a no-arg ctor for that
  class.  It takes a
        mandatory
 X509Certificate and optional PrivateKey. 
  That's a good
        example of the
 kind of things that changed.

  As I said, I am not that familiar with
 Maven, so I am not
  sure if I need to add some other
 dependencies in the pom, or
  do I need to modify code that uses
 those types that are
  getting the errors?

      Yes, definitely many
 types have been
  added/removed/modified, so
        the corresponding
 2.x code definitely must change.
      Wrt dependencies, you
 definitely need java-support
  from our
        projects,
 although if you're using Maven that will
  be resolved as
        a transitive
 dependency, as will all the other deps. 
  If not using
        Maven then you'd
 have to manually include all the
  right jars in
        your project.

  Also, as I said I have the
 dependencies configured for
  opensaml version 3.3.0, but is there
 not a 3.4.2 in Maven?

      Yes, 3.4.2 is the
 latest.

    -- 
  To unsubscribe from this list send an
 email to
  dev-unsubscribe at shibboleth.net
  -----Inline Attachment Follows-----