SAML Assertion in Servlet

[Peter Schober]

* Peter Schober <peter.schober at univie.ac.at> [2016-05-26 13:11]:
> * Per Jørgen Vigdal <Per.Jorgen.Vigdal at evry.com> [2016-05-26 13:04]:
> > Is there a way to get hold of the whole SAML Assertion in my servlet.
> > Something like this :
> > String SAMLAssertion  = request.getHeader("SAMLAssertion");
> 
> Assuming your Java servlet is using the Shibboleth SP the answer can
> be found here (second result when searching the SHIB2 wiki space for
> "assertion"):
> https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPAssertionExport
> which also includes the "algorithm" to use, in prose.

Here's some pseudo-code (actual working Python code) for illustration:

def get_assertion():
    count = request.environ['Shib-Assertion-Count']
    assertions = []
    for i in range(1,int(count)+1):
        ass = "Shib-Assertion-%02d" % (i,)
        url = request.environ[ass]
        doc = urllib2.urlopen(url).read()
        assertions.append(doc)
    return assertions

Cheers,
-peter