<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<p><br>
</p>
<br>
<div class="moz-cite-prefix">On 5/8/16 3:42 PM, Stefan Rasmusson
wrote:<br>
</div>
<blockquote
cite="mid:CACdgycjwXzxjoL6X28Uff=4jTTNgA=NaSzpp5gF21PjTTaj-EA@mail.gmail.com"
type="cite">
<div dir="ltr">Ok, so what would be the correct way of using the
handlers?</div>
</blockquote>
<br>
At this point I'm not clear what you're asking. Maybe you can
clarify with a concrete example?<br>
<br>
The thread started out as how to use the SOAP client, which is a
client-side question. Later you asked "<span class="">how can I use
the MessageLifetimeSecurityHandler with
the HTTPRedirectDeflateDecoder". The latter decoder impl is only
for server-side. You can't use the </span><span class="">HTTPRedirectDeflateDecoder
on a SOAP client (or any client period), it's used on the
server-side when processing an inbound HttpServletRequest using
that binding.</span><br>
<br>
<br>
<blockquote
cite="mid:CACdgycjwXzxjoL6X28Uff=4jTTNgA=NaSzpp5gF21PjTTaj-EA@mail.gmail.com"
type="cite">
<div dir="ltr"> Should there be a client implementation using the
HttpServletMessagePipeline? </div>
</blockquote>
<br>
There can't be one, that literally doesn't make any sense.
HttpServletMessagePipeline is by definition for the server-side. A
SOAP client doesn't have an HttpServletRequest/-Response.<br>
<br>
(Unless by "client" you mean perhaps an SP sending an AuthnRequest,
etc. I wouldn't really call that "client", but it is appropriate to
use server-side components there on an SP of course. The
HttpServletMessagePipeline probably isn't appropriate there though,
since the SP case is like a "half-duplex" case, unlike the IdP
case.)<br>
<br>
<br>
<blockquote
cite="mid:CACdgycjwXzxjoL6X28Uff=4jTTNgA=NaSzpp5gF21PjTTaj-EA@mail.gmail.com"
type="cite">
<div dir="ltr">Or is it just as well to call the handlers straight
on? I want to understand how the different components stick
together.</div>
</blockquote>
<br>
<br>
Well, *something* has to call the handlers. In the pipeline SOAP
client, that code itself orchestrates the whole pipeline by invoking
the encoder, decoder and handlers in the proper sequence.<br>
<br>
For server-side, the order of operations is reversed from the
client-side. And because of the nature of the server-side
environment, we can't really ship some single component which
actually invokes everything, since all the important details are
really specific to the server's environment/framework. It's up to
your server-side components to do that.<br>
<br>
The main point I have been trying to make is that: most of the
handlers, like the signature signing and validation ones, can be
used either with the SOAP client or for server-side (IdP/SP).
That's because they operate on the logical message as represented by
a MessageContext, and don't care where the message data came from.<br>
<br>
The main difference between the client and server cases is that you
need different auxiliary handlers to populate certain context data
that is used as input by the other handlers, like the signature
ones.<br>
<br>
<br>
</body>
</html>