<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none"><!-- p { margin-top: 0px; margin-bottom: 0px; } @font-face { font-family: 'Cambria Math'; } @font-face { font-family: Calibri; } p.MsoNormal, li.MsoNormal, div.MsoNormal { margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; } a:link, span.MsoHyperlink { color: blue; text-decoration: underline; } a:visited, span.MsoHyperlinkFollowed { color: purple; text-decoration: underline; } span.EmailStyle17 { font-family: Calibri, sans-serif; color: windowtext; } @page WordSection1 { margin: 70.85pt; }--></style>
</head>
<body dir="ltr" style="font-size:12pt;color:#000000;background-color:#FFFFFF;font-family:Calibri,Arial,Helvetica,sans-serif;">
<p>Historically trying to use XML within a SAML Attribute Value leads to a myriad of interoperability nightmares (it is allowed by the standards and saml schemas, but varies dramatically how it is handled by implementations). If you do need to send XML in
an attribute value, you may be better off encoding the attribute value before passing it into OpenSAML so you have better control (base64 encoding it is usually a good option).<br>
</p>
<p><br>
</p>
<p>I would also note that in your example, it seems like you just want to handle multiple attribute values... If that is all you want, an attribute can have multiple AttributeValue statements:<br>
</p>
<p><br>
</p>
<p><saml:Attribute ...><br>
</p>
<p> <saml:AttributeValue>...</><br>
</p>
<p> <saml:AttributeValue>...</><br>
</p>
<p></><br>
</p>
<p><br>
</p>
<p> <br>
</p>
<div style="color: rgb(33, 33, 33);">
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" color="#000000" style="font-size:11pt"><b>From:</b> dev <dev-bounces@shibboleth.net> on behalf of LECUYER, Dominic <dominic.lecuyer@capgemini.com><br>
<b>Sent:</b> Tuesday, April 21, 2015 3:55 AM<br>
<b>To:</b> dev@shibboleth.net<br>
<b>Subject:</b> </font>
<div> </div>
</div>
<div>
<div class="WordSection1">
<p class="MsoNormal"><span lang="EN-US">Hello,</span></p>
<p class="MsoNormal"><span lang="EN-US"> </span></p>
<p class="MsoNormal"><span lang="EN-US">I’ve been using OpenSAML for more than a year now, but it has always been transparent with the use of Apache CXF Security Token Service and WSS4J.</span></p>
<p class="MsoNormal"><span lang="EN-US"> </span></p>
<p class="MsoNormal"><span lang="EN-US">Now my needs have become I little more complicated.
</span></p>
<p class="MsoNormal"><span lang="EN-US"> </span></p>
<p class="MsoNormal"><span lang="EN-US">I would like to create an attribute in my SAML assertion token. The difficult part is I want this content to be a complex type. Instead of explaining see what I get :</span></p>
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0" style="border-collapse:collapse">
<tbody>
<tr>
<td width="636" valign="top" style="width:477.3pt; border:solid windowtext 1.0pt; padding:0cm 5.4pt 0cm 5.4pt">
<p class="MsoNormal"><span lang="EN-US"><saml2:Attribute Name="<a href="http://cwix.act.nato.int/clearance">http://cwix.act.nato.int/clearance</a>" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified"></span></p>
<p class="MsoNormal"><span lang="EN-US"> <saml2:AttributeValue xsi:type="xsd:string"><ns2:Clearance xmlns:ns2="<a href="http://xiwc/2015/02/clearance">http://xiwc/2015/02/clearance</a>" xmlns="<a href="http://xiwc/2015/02/identities">http://xiwc/2015/02/identities</a>"
xmlns:ns3="<a href="http://xiwc/2014/06/nl/cl">http://xiwc/2014/06/nl/cl</a>"><ns2:Classifications><ns2:Classification>SECRET</ns2:Classification><ns2:Classification>CONFIDENTIAL</ns2:Classification><ns2:Classification>RESTRICTED</ns2:Classification><ns2:Classification>UNCLASSIFIED</ns2:Classification></ns2:Classifications></ns2:Clearance></saml2:AttributeValue></span></p>
<p class="MsoNormal"><span lang="EN-US"> </saml2:Attribute></span></p>
<p class="MsoNormal"><span lang="EN-US"> </span></p>
</td>
</tr>
</tbody>
</table>
<p class="MsoNormal"><span lang="EN-US"> </span></p>
<p class="MsoNormal"><span lang="EN-US"> </span></p>
<p class="MsoNormal"><span lang="EN-US"> </span></p>
<p class="MsoNormal"><span lang="EN-US">My problem is the escaping of the characters. I am using OpenSaml 3.1.0 and this is how I added this attribute (inspired from ):
</span></p>
<p class="MsoNormal"><span lang="EN-US"> </span></p>
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0" style="border-collapse:collapse">
<tbody>
<tr>
<td width="636" valign="top" style="width:477.3pt; border:solid windowtext 1.0pt; padding:0cm 5.4pt 0cm 5.4pt">
<p class="MsoNormal"><span lang="EN-US">try {</span></p>
<p class="MsoNormal"><span lang="EN-US"> InitializationService.initialize();</span></p>
<p class="MsoNormal"><span lang="EN-US"> } catch (InitializationException ex) {</span></p>
<p class="MsoNormal"><span lang="EN-US"> Logger.getLogger(RepositoryClaimsHandler.class.getName()).log(Level.SEVERE, null, ex);</span></p>
<p class="MsoNormal"><span lang="EN-US"> }</span></p>
<p class="MsoNormal"><span lang="EN-US"> XMLObjectBuilderFactory builderFactory = XMLObjectProviderRegistrySupport.getBuilderFactory();</span></p>
<p class="MsoNormal"><span lang="EN-US"> </span></p>
<p class="MsoNormal"><span lang="EN-US"> XMLObjectBuilder<XSString> xsStringBuilder</span></p>
<p class="MsoNormal"><span lang="EN-US"> = (XMLObjectBuilder<XSString>) builderFactory.getBuilder(XSString.TYPE_NAME);</span></p>
<p class="MsoNormal"><span lang="EN-US"> XSString attributeValue</span></p>
<p class="MsoNormal"><span lang="EN-US"> = xsStringBuilder.buildObject(AttributeValue.DEFAULT_ELEMENT_NAME, XSString.TYPE_NAME);</span></p>
<p class="MsoNormal"><span lang="EN-US"> attributeValue.setValue(writer.toString());</span></p>
</td>
</tr>
</tbody>
</table>
<p class="MsoNormal"><span lang="EN-US"> </span></p>
<p class="MsoNormal"><span lang="EN-US">I also tried with the XSAny type and the “xsAnyAttributeValue.getUnknownXMLObjects().add(myXSStringType)” with no success</span></p>
<p class="MsoNormal"><span lang="EN-US"> </span></p>
<p class="MsoNormal"><span lang="EN-US">I looked at the marshaller and, in a JAXB kind of way, tried to disable character escaping but I couldn’t find how to make this configuration .</span></p>
<p class="MsoNormal"><span lang="EN-US"> </span></p>
<p class="MsoNormal"><span lang="EN-US">I am now thinking of how to create my own AbstractXMLObject extentions and factories but this seems to be excessive work with unsure results ^^.</span></p>
<p class="MsoNormal"><span lang="EN-US"> </span></p>
<p class="MsoNormal"><span lang="EN-US">That’s why I write to you. Do you have an idea on how to deal with this ?</span></p>
<p class="MsoNormal"><span lang="EN-US"> </span></p>
<p class="MsoNormal"><span lang="EN-US"> </span></p>
<p class="MsoNormal"><span lang="EN-US">Regards,</span></p>
<p class="MsoNormal"><span lang="EN-US">Dominic Lécuyer </span></p>
<p class="MsoNormal"> </p>
<p class="MsoNormal"> </p>
</div>
<span style="font-size:9px; line-height:10px">This message contains information that may be privileged or confidential and is the property of the Capgemini Group. It is intended only for the person to whom it is addressed. If you are not the intended recipient,
you are not authorized to read, print, retain, copy, disseminate, distribute, or use this message or any part thereof. If you receive this message in error, please notify the sender immediately and delete all copies of this message.</span>
</div>
</div>
</body>
</html>