Simple Java client for accessing Shibboleth-protected services?

[Cantor, Scott]

On 6/13/13 6:16 PM, "Richard Eckart de Castilho"
<richard.eckart at gmail.com> wrote:
>
>What I currently have is actually based on the "bash" version listed
>there,
>ported to Java and using the (un)marshaling code from OpenSAML. For some
>reason I didn't really grok the Java examples listed there. They all
>appeared
>either not to go the whole way or to be not really as simple as I wanted
>them to be.

The OpenSAML Java code is primarily there to address the complexity that
signatures impose. There are usually ways to simplify that work, and ECP
makes very specific and minimal assumptions about the client's
capabilities, but you're still forwarding signed XML and that's very easy
to botch.

Secondly, there are critical pieces left out of scope of the profile that
no existing clients have real solutions for dealing with, such as
provisioning IdP information into the client, and most of all, being able
to verify the IdP identity in some meaningful way (the word "meaningful"
disqualifies commercial TLS).

That part in particular usually involves some wrestling with dumb/broken
HTTP stacks that think TLS is "magic".

The rest of this conversation probably should be on dev.

>I'm using httpclient 4.2.3 (latest version 4.2.5). Given that I'm not
>aiming
>for a very sophisticated implementation and that I'm not a httpclient
>expert, I'm surely not using its API in a very smart way.

I wasn't commenting on anything you might have done, but that borrowing
from that other code would put you with a much less robust version.

-- Scott