<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<p><br>
</p>
<div class="moz-cite-prefix">On 2/15/19 2:55 PM, o haya wrote:<br>
</div>
<blockquote type="cite"
cite="mid:404246862.1712375.1550260506729@mail.yahoo.com">
<pre class="moz-quote-pre" wrap="">
I am just getting started with OpenSAML, and using Java and OpenSAML 2.6.6 </pre>
</blockquote>
<p><br>
</p>
<p>Don't. Use the latest 3.x OpenSAML 2.x has been End Of Life for
over 2.5 years at this point. See the announcement and links here:</p>
<p><a class="moz-txt-link-freetext" href="https://wiki.shibboleth.net/confluence/display/OpenSAML/Home">https://wiki.shibboleth.net/confluence/display/OpenSAML/Home</a><br>
</p>
<p> There's absolutely no reason to start a new project with 2.x,
and it is indeed a bad idea due to security vulnerabilities which
have been fixed since it went EOL.<br>
</p>
<p><br>
</p>
<blockquote type="cite"
cite="mid:404246862.1712375.1550260506729@mail.yahoo.com">
<pre class="moz-quote-pre" wrap="">
I have code now that, in fact does add the <Conditions>, but I am ending up with two <saml:AudienceRestriction> elements. </pre>
</blockquote>
<p><br>
</p>
<p>Yes, you are adding it twice.</p>
<p><br>
</p>
<blockquote type="cite"
cite="mid:404246862.1712375.1550260506729@mail.yahoo.com">
<pre class="moz-quote-pre" wrap="">
whereas I think that what I want is (i.e., just the one saml2:AudienceRestriction with the URI):
<saml2:Conditions NotOnOrAfter="2019-02-15T19:27:56.620Z" NotBefore="2019-02-15T19:27:56.603Z">
<saml2:AudienceRestriction>
<saml2:Audience><a class="moz-txt-link-freetext" href="https://sandboxdtm01.xxx.dev/fed">https://sandboxdtm01.xxx.dev/fed</a></saml2:Audience>
</saml2:AudienceRestriction>
</saml2:Conditions>
</pre>
</blockquote>
<p><br>
</p>
<p>Correct. An empty AudienceRestriction would not make any sense.
It might even be schema-invalid, I'd have to check.<br>
</p>
<p><br>
</p>
<blockquote type="cite"
cite="mid:404246862.1712375.1550260506729@mail.yahoo.com">
<pre class="moz-quote-pre" wrap="">
The part of my code that is building that is:
SAMLObjectBuilder audienceRestrictionConditionBuilder = (SAMLObjectBuilder) SAMLWriter.getSAMLBuilder().getBuilder(AudienceRestriction.DEFAULT_ELEMENT_NAME);
Condition condition = (Condition) audienceRestrictionConditionBuilder.buildObject();</pre>
</blockquote>
<p><br>
</p>
<p>Here you are building the empty one ...</p>
<p><br>
</p>
<blockquote type="cite"
cite="mid:404246862.1712375.1550260506729@mail.yahoo.com">
<pre class="moz-quote-pre" wrap="">
SAMLObjectBuilder conditionsBuilder = (SAMLObjectBuilder) SAMLWriter.getSAMLBuilder().getBuilder(Conditions.DEFAULT_ELEMENT_NAME);
Conditions conditions = (Conditions) conditionsBuilder.buildObject();
conditions.getConditions().add(condition);</pre>
</blockquote>
<p><br>
</p>
<p>... and here you are adding the empty one to the Conditions. You
don't need to do this, or the above.</p>
<p><br>
</p>
<blockquote type="cite"
cite="mid:404246862.1712375.1550260506729@mail.yahoo.com">
<pre class="moz-quote-pre" wrap="">
// Create the audience restriction
AudienceRestriction audienceRestriction = (AudienceRestriction) audienceRestrictionnBuilder.buildObject();
// add in the audience
audienceRestriction.getAudiences().add(audience);
conditions.getAudienceRestrictions().add(audienceRestriction);</pre>
</blockquote>
<p><br>
</p>
<p>And here you are adding the non-empty one, which is the code to
keep.</p>
<p><br>
</p>
<p><br>
</p>
<blockquote type="cite"
cite="mid:404246862.1712375.1550260506729@mail.yahoo.com">
<pre class="moz-quote-pre" wrap="">
It seems like just instantiating the builder is making the empty saml2:AudienceRestriction, but I don't know how to make an "empty" builder?</pre>
</blockquote>
<p><br>
</p>
<p>No, that's not correct. Instantiating a builder does not make
anything (other than the builder of course). Calling one of the
build(...) methods is what makes the SAMLObject. So there's no
such thing as an "empty" builder.<br>
</p>
<br>
</body>
</html>