<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<p><br>
</p>
<br>
<div class="moz-cite-prefix">On 5/1/16 2:31 PM, Stefan Rasmusson
wrote:<br>
</div>
<blockquote
cite="mid:CACdgycgL30tOqsk6gdn49Z3wJzOnnY+HNfkQT3dCaHLTvvMhvw@mail.gmail.com"
type="cite">
<div dir="ltr">
<div class="gmail_extra"><br>
<div class="gmail_quote">On Sat, Apr 30, 2016 at 8:28 PM,
Brent Putman <span dir="ltr"><<a moz-do-not-send="true"
href="mailto:putmanb@georgetown.edu" target="_blank">putmanb@georgetown.edu</a>></span>
wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0
.8ex;border-left:1px #ccc solid;padding-left:1ex">There's
probably a slight bit of more work to do there, as many of
the inbound handlers like this one would require things to
be populated in the inbound MessageContext, like a
SignatureValidationParameters with a TrustEngine, etc.
That sort of thing is likely a bit different on the
server- vs client-side, because of the environmental
differences, and is one of the things I'm working on right
now. The existing server-side code is implemented as a
ProfileAction processing a ProfileRequestContext, which
doesn't work for the SOAP client case.</blockquote>
</div>
<br>
Ok, so the SAML context has to be manually populated for the
handlers?<br>
</div>
</div>
</blockquote>
<br>
If you meant MessageContext, yes. (There are many "SAML-"
contexts.) The general model is the (in this case inbound)
MessageContext must be populated early on with data that is required
before the other relevant message handlers run. Typically this
means that you will have MessageHandlers (or as in the IdP,
ProfileActions) which run early, before the "real" message handlers
like the signature validation one, and populate various subcontexts
with data.<br>
<br>
Looking at the SAMLProtocolMessageXMLSignatureSecurityHandler, it
needs:<br>
<br>
- SAMLPeerEntityContext: populated with the SAML role QName (the
entityID is usually resolved automatically)<br>
<br>
- SAMLProtocolContext: populated with the SAML protocol URI<br>
<br>
- SecurityParametersContext: populated with a
SignatureValidationParameters containing at least the TrustEngine<br>
<br>
<br>
So for the SOAP client you need a MessageHandler that does that.
For the IdP, the official one will based on injected lookup
functions, which reference IdP configuration, and implicitly SAML
metadata. Your use case is probably different, so don't know
how/where you'd get the required data. But the layer of abstraction
is the MessageContext subcontext data - it doesn't matter how the
data gets there, only that it is present.<br>
</body>
</html>