OpenSAML user discussion

["Scott Cantor" <>]

> This code goes well If I call SAMLAssertion#toString()
> before creating SAMLResponse. But I think this is a wrong way 
> to escape.

This appears to be the DOM deferral bug that was noticed after the release
of 1.1b. There's a fix in cvs, but it hasn't been released because the use
case is a little obscure.

You can work around the bug in most cases by reusing a common Document
instead of forcing adoption to happen. Just get the document from the
assertion parse (toDOM().getOwnerDocument()) and pass that to the
SAMLResponse.toDOM() method so that it reuses that DOM. That's more
efficient anyway.

Alternatively I can point you at the fix, which is in the XML.java
classfile:

http://anoncvs.internet2.edu/cgi-bin/viewcvs.cgi/opensaml/java/src/org/opens
aml/XML.java.diff?r1=1.27.2.1&r2=1.27.2.2

You have to add:

dbf.setFeature(
        "http://apache.org/xml/features/dom/defer-node-expansion";, 
        false
);

when building the DocumentBuilderFactory. Default defers expansion and their
own DOM implementation doesn't check for this and fully expand when
required.

-- Scott