Using OpenSAML as an idependent library

[Josh Cummings]

The other day, I read that OpenSAML is not supported for use as an
independent library [1]:

> We don't formally support OpenSAML for use as an independent library,
only as part of our IdP product.

Spring Security's SAML 2.0 Service Provider support uses OpenSAML 3 [2] as
an independent library. I'm currently in the process of adding OpenSAML 4
to that support [3]. Is this not recommended?

I got confused since the documentation has a section titled "Projects Using
OpenSAML" [4] that lists several projects that use OpenSAML as an
independent library.

That same page also says:

> The current stable release of the Java library is the latest version
available from our Nexus repository ... in most cases you can assume that
all prior releases are unsupported.

which seems to imply some form of support for the current stable release.

Can you clarify what is supported and what isn't? If it's not recommended
for Spring Security to base its Service Provider support on OpenSAML, do
you have any alternatives you would recommend?

Thanks!

[1] -
https://shibboleth.1660669.n2.nabble.com/Security-issue-on-Java-OpenSaml-Library-td7646686.html
[2] -
https://github.com/spring-projects/spring-security/blob/master/saml2/saml2-service-provider/spring-security-saml2-service-provider.gradle
[3] - https://github.com/spring-projects/spring-security/issues/9095
[4] -
https://wiki.shibboleth.net/confluence/display/OS30/Home#Home-ProjectsUsingOpenSAML
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20210304/876cd434/attachment.htm>