OpenSaml: BinarySecurityTokenMarshaller generates ValueType as EncodingType

[Brent Putman]

On 9/2/20 5:18 PM, Patrick Peer wrote:
> Hi Brent,
>
> I am tasked to assemble a security token renew request, with 
> signature and the whole shebang. To do so, I utilize the Java 
> implementation of OpenSaml. I ran into a problem and it seems easier 
> to contact you directly instead of jumping through the hoops 
> necessary to open a Jira issue.


First, please do not email the developers directly.  Use the dev list 
(copied on this reply): https://www.shibboleth.net/community/

Second, if you think you have found a bug and want it addressed, please 
do open a Jira issue.  That is the way that issues get addressed.


>
> The BinarySecurityToken is required to have the EncodingType and 
> ValueType attributes. However, the ValueType is never marshalled. 
> Digging a bit, I found that the BinarySecurityTokenMarshaller uses 
> the String "EncodingType" for the ValueType I provide. Digging even 
> deeper I could track this down to 
> commit d53f2af26987075774350ccb8d60db9110247638, which seems to split 
> up the code for the two Types. Before, both were rendered 
> within BinarySecurityTokenMarshaller with their respective correct names.


This was contributed code from someone else over a decade ago and has 
not been thoroughly tested.


>
> I'd be grateful for any insights, as It seems I will need to find a 
> workaround to meet my deadlines. Currently I think I will just alter 
> the DOM before generating the signature. I would prefer to not 
> compile and distribute the openSaml library myself.
>

Seems like a simple typo type of bug in the marshaller. We can fix it 
but I can't currently guarantee when we will do another release. You 
didn't mention whether you are using 3.x or 4.x. It's quite likely we 
will not be doing another release of 3.x at all.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20200902/338be532/attachment.htm>