<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">Hi Brent<div class=""><br class=""></div><div class="">Thank you so much for taking the time to provide your thoughts in these trying times. I hope you all are well. </div><div class=""><br class=""></div><div class="">I heard about V4 and see the release notes, but the new version is not in the Maven Central repository. My project is a Maven Reactor module for Apache Sling, and the Slings devs asked me not to add the shib<a href="https://wiki.shibboleth.net/confluence/display/IDP30/GettingStarted#GettingStarted-AddShibbolethrepositoriestoyourPOM" class=""> artifact repositories</a> for OpenSAML. Because there is <a href="https://mvnrepository.com/artifact/org.opensaml/opensaml-core" class="">precedent</a> of them being in Maven Central, this is where they wanted to get it. If you pushed V4 to Central, then I would upgrade to that version.</div><div class=""><br class=""></div><div class=""><div class="">OSGI offers some advantages over traditional Java runtime environments. Major players are building on platforms like these. Others might prefer Spring or commercial products. Those is not interesting to me right now. I am doing this for the sake of the open-source projects that I believe in. Apache Sling, Oak and Felix OSGI are excellent Java frameworks. The support I am get from those developer communities is great. They know Sling and OSGI very well. OpenSAML is the best SAML2 library for Java. Bringing these together could be very powerful! And I hear your words of caution. It was stated repeatedly in the ‘readme,' but let say it again... This is not a production assignment. I am doing it because it is interesting and potentially useful work. As you know, open-source is a team effort to ensure security, quality and advancement are maintained. Developing in the open with as many eyes and brains as possible helps ensure these goals.</div></div><div class=""><br class=""></div><div class="">Thanks agin!</div><div class=""><div class="">
<div dir="auto" style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div dir="auto" style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div dir="auto" style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div dir="auto" style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div dir="auto" style="text-align: start; text-indent: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div dir="auto" style="text-align: start; text-indent: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div style="text-align: start; text-indent: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div style="text-align: start; text-indent: 0px;">Cris </div></div></div></div></div></div></div></div></div>
</div>
<div><br class=""><blockquote type="cite" class=""><div class="">On Apr 2, 2020, at 3:58 PM, Brent Putman <<a href="mailto:putmanb@georgetown.edu" class="">putmanb@georgetown.edu</a>> wrote:</div><br class="Apple-interchange-newline"><div class="">
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" class="">
<div class=""><p class=""><br class="">
</p>
<div class="moz-cite-prefix">On 3/30/20 5:35 PM, Cris Rockwell
wrote:<br class="">
</div>
<blockquote type="cite" cite="mid:B3A2930C-2CB8-4598-82DE-03DEAC691E78@umich.edu" class="">
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" class="">
<div class="">Hello Shibboleth Developers</div>
<div class=""><br class="">
</div>
<div class="">Here is a project under way using OpenSAML to build
a service provider module for Apache Sling within Felix OSGI. <a href="https://github.com/cmrockwell/sling-whiteboard-saml/tree/sling-saml2-service-provider/saml-handler" class="" moz-do-not-send="true">https://github.com/cmrockwell/sling-whiteboard-saml/tree/sling-saml2-service-provider/saml-handler</a> After
a few weeks of effort, my SP is working, but still needs a lot
of work. It would be my honor if any of you experienced in Java
development would review some of my OpenSAML code. <br class="">
</div>
</blockquote><p class=""><br class="">
</p><p class="">I don't know anything about Sling or OSGi. But building a SAML
SP is a ton of work. There's lots of stuff to know. The
consequences of getting it wrong is that you application will be
vulnerable. If you're going to do this, you really need to do an
in-depth read of the SAML specifications. And understand it all.
There's no shortcut around that.</p><p class="">I don't know that environment, but if I were you, I would
investigate and consider whether there is an existing known-good
SAML SP implementation that could be used instead of developing
your own.<br class="">
</p><p class=""><br class="">
</p>
<blockquote type="cite" cite="mid:B3A2930C-2CB8-4598-82DE-03DEAC691E78@umich.edu" class="">
<div class=""><br class="">
</div>
<div class="">1. While the <i class="">Guide to OpenSAML V3</i> was
a very useful primer, and I referenced the example project
pretty heavily.</div>
</blockquote><p class=""><br class="">
</p><p class="">Just FYI, v4 was released recently, and you'd definitely want to
use that. It has new SP-centric components that are essential to
what you are trying to do. <br class="">
</p><p class=""><br class="">
</p>
<blockquote type="cite" cite="mid:B3A2930C-2CB8-4598-82DE-03DEAC691E78@umich.edu" class="">
<div class=""> That demo project uses a hard-coded Java Keystore
(/resources/SPKeystore.jks) Can you make any recommendation or
refer me to reference projects that would make this
configurable? <br class="">
</div>
</blockquote><p class=""><br class="">
</p><p class="">I don't know what kind of configurability you mean. In
Shibboleth, we don't generally use Java keystores. We have
component support to use certs and keys directly stored in the
filesystem and loaded via various types of CredentialResolvers and
Spring support code. For peer credentials (e.g. validating a
signature you receive), we pretty much use SAML Metadata
exclusively, which has its own set of support components.<br class="">
</p><p class=""><br class="">
</p>
<blockquote type="cite" cite="mid:B3A2930C-2CB8-4598-82DE-03DEAC691E78@umich.edu" class="">
<div class=""><br class="">
</div>
<div class="">2. The OpenSAML calls in
AuthenticationHandlerSAML2.java could use your expertise… <a href="https://github.com/cmrockwell/sling-whiteboard-saml/blob/sling-saml2-service-provider/saml-handler/src/main/java/org/apache/sling/auth/saml2/AuthenticationHandlerSAML2.java" class="" moz-do-not-send="true">https://github.com/cmrockwell/sling-whiteboard-saml/blob/sling-saml2-service-provider/saml-handler/src/main/java/org/apache/sling/auth/saml2/AuthenticationHandlerSAML2.java</a></div>
<br class="">
</blockquote><p class=""><br class="">
</p><p class="">Well, just glancing at the main part that you really, really,
really have to get right... In activate(), where you seem to be
processing the Response that has been submitted to the ACS
endpoint, it seems the only SAML processing you are doing is
decrypting the Assertion and validating its signature. That's
about 5 % of what you need worry about.</p><p class="">Screwing that up will lead to your app being completely
vulnerable to compromise. You really have to fully understand the
processing requirements of SAML, and then implement them. For the
former you really need to read and understand all the relevant
parts of the SAML specs.</p><p class="">For the latter, as of v4, OpenSAML has most or all of the
SP-centric components you would need to do that. But you have to
put them together in the right ways, and configure them
appropriately, etc. That is likely way more than I or any of the
Shib team can describe in an email exchange.</p><p class="">What I could point you to is the new SAML authentication flow
support in the IdP that uses those components. It's not quite
exactly what you are doing here, because of the IdP-acting-as-SP
aspect, but the SP parts are essentially the same as what you'd
need to do.</p><p class="">Understanding it all means at the very least Spring Framework and
Spring Webflow. The SAML authn flow is here:</p><p class=""><a class="moz-txt-link-freetext" href="http://git.shibboleth.net/view/?p=java-identity-provider.git;a=blob;f=idp-conf/src/main/resources/system/flows/authn/saml-authn-flow.xml;hb=refs/heads/master">http://git.shibboleth.net/view/?p=java-identity-provider.git;a=blob;f=idp-conf/src/main/resources/system/flows/authn/saml-authn-flow.xml;hb=refs/heads/master</a>
<br class="">
</p><p class="">and the direct beans it references are here:</p><p class=""><a class="moz-txt-link-freetext" href="http://git.shibboleth.net/view/?p=java-identity-provider.git;a=blob;f=idp-conf/src/main/resources/system/flows/authn/saml-authn-beans.xml;hb=refs/heads/master">http://git.shibboleth.net/view/?p=java-identity-provider.git;a=blob;f=idp-conf/src/main/resources/system/flows/authn/saml-authn-beans.xml;hb=refs/heads/master</a></p><p class="">There's lots of other beans referenced from those and that live
across many files in the IdP project, but that's where to start.<br class="">
</p><p class="">What you need to know about for the SP side of things is mostly
in the ProcessResponse action. Pay particular attention to the
HandleResponse and ValidateAssertions steps.</p><p class="">That's the pointers I can provide. If/when you get to the point
of having specific questions, you can post them to the list.<br class="">
</p><p class="">--Brent<br class="">
</p>
</div>
-- <br class="">To unsubscribe from this list send an email to <a href="mailto:dev-unsubscribe@shibboleth.net" class="">dev-unsubscribe@shibboleth.net</a></div></blockquote></div><br class=""></div></body></html>