OpenSAML user discussion

[Jean-Noel Colin <>]

Scott

OK, so what i'm doing now is:

            InputSource is = new InputSource(new StringReader(token));
            ParserPool p = new ParserPool();
            Document doc = p.parse(is, p.getDefaultSchema());
            SAMLAssertion assertion = new SAMLAssertion(doc.getDocumentElement());

And this properly builds the assertion from the String I receive.

Thanks a lot

Jean-Noel

Scott Cantor wrote:

What do you mean by passing the input source to OpenSAML? 
    

I mean any time you parse any XML that you expect to pass into OpenSAML, you
have to get the parser object from XML.ParserPool first. Failing to do that
will result in random crashes if data is invalid and almost certainly
signature verification failures.

In this case, the parser object is bogus, it wasn't even namespace aware. If
you want to configure your own parser, you can do it at your own risk, but
there are many properties you have to set.

  

The OpenSAML parser engine is XML.ParserPool, isn't it?
    

Yes, which you're *not* using in your sample code, that's the bug. There are
shortcut methods for parsing from any type of standard input source.

-- Scott