OpenSAML user discussion

[Brent Putman <>]

Brad Anderson wrote:
> Yes, this is in a web app, as SSO - a .NET shop is sending us assertions after
> authenticated users click on a link in their portal to our site.  A servlet
> gathers the assertion out of the request and verifies dates, issuer, and
> hopefully soon, the digsig.
>
> We're using Tomcat and the three jar files are indeed in tomcat/common/lib.  A
> rework could put them in tomcat/conf, potentially?
>
>   


Ok, thanks for the info.   Assuming you are using our Ant build.xml to 
build the jars - I realized after I sent the last note that I had 
forgotten to fix the build file to copy the conf files to the right 
place, so the conf files wouldn't have been making it into the 
xmltooling jar at all.  I believe I have that fixed now.  Grab the new 
java-xmltooling build.xml and give it another try.

No, by reworking I meant changing how, where and/or by whom the 
signature and encryption object provider config files get loaded.  I 
thought there might be issues with finding and loading them as resources 
the way we do now.  There still is at least one issue, I believe, namely 
that xmltooling and opensaml jars have to be loaded by the same 
classloader, but we decided we would live with that for now.