Sorry for taking so long to respond. I didn't realize there is a post. Yes I'm sure I need to create SAML 1.0. We're testing against a really (super duper) old security gateway and it only accepts 1.0. I traced through the code and realized that 1.0, like you said is not supported. As a matter of fact, when I set SAML to 1.0, Assertion.java simply ignores the request, that is why I was getting all these null pointer exception, etc.
My plan right now is to change the interceptor so that it changes the 1.1 version to 1.0 since they look pretty alike anyways. However now I ran into another problem, I can't set 2 actions, 1 for signature (for the whole message) and 1 for saml. There can only be 1 action in each WSS4jOutInterceptor and it always create a new header anyways. Is there no other way around this other than to rewrite some of the WSS4JOutInterceptor code? It seems that it must be rather common for people to create a SAML and have the message and SAML be both signed. Any suggestion? -- View this message in context: http://cxf.547215.n5.nabble.com/cxf-and-saml1-0-tp5034076p5053973.html Sent from the cxf-user mailing list archive at Nabble.com.
