Using OpenSAML as an idependent library

[Cantor, Scott]

On 3/4/21, 8:48 AM, "users on behalf of Josh Cummings" <users-bounces at shibboleth.net on behalf of josh.cummings+shibboleth at gmail.com> wrote:

>    Spring Security's SAML 2.0 Service Provider support uses OpenSAML 3 [2] as an independent library. I'm currently in the
> process of adding OpenSAML 4 to that support [3]. Is this not recommended?

We do not have documentation, nor any funding or resources, to help anybody use the library safely and many uses of the library are unsafe, poorly designed, and contribute negatively to the overall state of SAML support in the world. Making it clear we think it's a bad idea is the only mechanism we have to send that message when the code is open source and free for use, which is not something that's going to change.

We have been accused in the past of refusing to fix bugs that were in fact caused by others' misuse of our code, and the only way to stop that is to make it clear that people are on their own. If anybody, one single organization, were to fund the consortium strictly on the basis of wanting the library to be supported, that wouldn't really change the situation but it would be a start. Not one has. That says it all.

>    I got confused since the documentation has a section titled "Projects Using OpenSAML" [4] that lists several projects
> that use OpenSAML as an independent library.

That people use it is not an indication we think it's wise, but that list is quite old and from a different time.

>    which seems to imply some form of support for the current stable release. 

Security support in the event that an actual bug exists that does not derive from misuse. We do not release updates to the "unsupported" versions.

> If it's not recommended for Spring Security to base its Service Provider support on OpenSAML, do you have any
> alternatives you would recommend?

When it comes to Java, I (personally) would simply tell anybody to proxy from something else, or use Apache in front of it. There are no implementations in Java that I know of that are viable and not also based on OpenSAML.

But what I think doesn't really matter. The point of the statement was to get people to ask some questions, so it served its purpose.

-- Scott