OpenSAML user discussion

[Chad La Joie <>]

As we were just discussing on the Shib list.  OpenSAML itself is not an 
SP (or IdP).  The analogy I use is that OpenSAML vs. and SP is the 
difference between having an HTTP library and having a web server (Scott 
says socket library vs web server).

The discussion on the Shibboleth list was actually about a person using 
the Spring Security SAML module so that might be an option.  There is 
also oiosaml which is based on OpenSAML.  Both are native Java but I 
can't vouch for the completeness or security rigor of either one.

On 1/10/11 1:50 PM, Mark Barnes wrote:
> Thank you for your response, Scott.
>
> I am looking at Shibboleth SP now.
>
> One of the first things I noted is that, when using Java Servlets, the
> use of Apache is required. We don't use Apache. I'm not sure if we can
> make that switch or not.
>
> Are there any examples of using OpenSAML directly by the service itself
> that you can point me to?
>
> ---Mark
>
> *From:*
> [mailto:]
>  *On Behalf Of
> *Cantor, Scott E.
> *Sent:* 07 January, 2011 8:51 PM
> *To:* 
> <>
> *Cc:* 
>
> *Subject:* Re: [OpenSAML] Questions - Just starting out with OpenSAML
>
>
> On Jan 7, 2011, at 8:24 PM, "Mark Barnes" 
> <
> <mailto:>>
>  wrote:
>
>     It looks like OpenSAML will the perfect solution.
>
> I would strongly urge you to adopt a complete SP implementation, whether
> it's Shibboleth or otherwise. It's not a good use of time to reproduce
> all that work, nor are you likely to end up with a comparable feature
> set or maturity level of code.
>
>     I have downloaded the source and binaries for OpenSAML 2.3.1, and
>     have been reading the user's manual at
>     https://spaces.internet2.edu/display/OpenSAML/OSTwoUserManual. I
>     must admit to being quite confused.
>
> The gap between this toolkit and a mature SP is enormous, so get used to
> that feeling.
>
> The first example in the user's manual uses class BasicParserPool in
> package org.opensaml.xml.parse, but I can't seem find this package or
> even org.opensaml.xml . I browsed the jar file and the source and I just
> don't see it.
>
> There are two other libraries that opensaml depends on, openws and
> xmltooling. I believe the presumption now is that one is using maven to
> pull in all the right components and automate the process.
>
> -- Scott

--
Chad La Joie
http://itumi.biz
trusted identities, delivered