Help with a new OpenSAML SP

[Brent Putman]

Hi Cris,

On 4/4/20 11:44 AM, Cris Rockwell wrote:

>
> I heard about V4 and see the release notes, but the new version is 
> not in the Maven Central repository. My project is a Maven Reactor 
> module for Apache Sling, and the Slings devs asked me not to add the 
> shib artifact repositories 
> <https://wiki.shibboleth.net/confluence/display/IDP30/GettingStarted#GettingStarted-AddShibbolethrepositoriestoyourPOM> for 
> OpenSAML. Because there is precedent 
> <https://mvnrepository.com/artifact/org.opensaml/opensaml-core> of 
> them being in Maven Central, this is where they wanted to get it. If 
> you pushed V4 to Central, then I would upgrade to that version.


We actually have an entire Wiki page about Maven Central because it's a 
FAQ:

https://wiki.shibboleth.net/confluence/display/DEV/Use+of+Maven+Central

TL;DR: We have never added any of our project's artifacts there, and we 
won't be putting any up there (anytime soon, at least). You don't know 
where those binaries came from, and in our security middleware 
project's opinion they aren't safe to use.  (That might change if/when 
the Maven community wakes up to this problem, and starts mandating both 
that artifacts are signed and that Maven by default validates the 
signatures. So far they haven't seemed interested.)


> OSGI offers some advantages over traditional Java runtime 
> environments. Major players are building on platforms like these. 
> Others might prefer Spring or commercial products. Those is not 
> interesting to me right now. I am doing this for the sake of the 
> open-source projects that I believe in.
>

My references to Spring were not intended to imply that you should be 
using Spring in your project.  Merely that if you want to look at how 
an SP should work using OpenSAML components, the only thing to which we 
can point you as an example is the Shibboleth IdP, and that uses 
Spring. So reading and understanding our SP code requires some Spring 
knowledge, or at least willingness to learn it as you go.  That's all.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20200404/368ac1f8/attachment.html>