OpenSAML user discussion

["Scott Cantor" <>]

> Lets assume I were to generate Java binding classes from the SAML 1.1 
> XML Schema files. I assume that I will be able to use the JAXB generated 
> binding classes to:
> 
> a) Create SAML 1.1 Request/Response XML (Marshal Java to XML use case)
> b) Process SAML 1.1 Request/Response XML(Marshal from XML to 
> Java use case)

I have no idea at all, I don't use JAXB. I'm skeptical because validation
support is so hit or miss in so many XML tools whether any non-trivial
schema could ever be auto-generated into anything useful.

I made the decision not to generate the code because I wanted portability to
C++. I don't regret it. It's not enough code to worry about, and the
standard is a stable schema, so it's not like it's constantly changing.

I also wanted more control over object creation, copying, etc. I did not
want every sub-object to be parsing and reparsing XML all over the place.

> I am curious what other advantages the opensaml toolkit would provide 
> above and beyond (a) and (b) when compared with the JAXB based approach 
> described above.

Well, for one thing, JAXB isn't going to handle digital signatures (or
encryption in the future). That's most of the effort anyway.

There are also other classes for the SOAP binding and POST profile,
particular on the C++ side these days, that do additional work and provide
the needed hooks to customize behavior. As Shib has evolved, the underlying
classes in OpenSAML have evolved to put the dividing line in the right
place. I have some work to do to get the Java in shape in that respect.

-- Scott