SAML works, however if you want to use an external issuer, you will need
to subclass WSDoallSender/Receiver to supply your own assertions to
wss4j. Apart from that, SAML in wss4j is treated like a signed message.
Another issue that I ran into using SAML in wss4j is that for
holder-of-key, you will need to check client assertions against message
signing information manually. There is no check to make sure all
signatures in the assertion match up, just that an assertion is present.
I have some stuff posted online that may be useful.
http://narawiki.umiacs.umd.edu/twiki/bin/view/Lab/SamlTutorial It's
mainly geared towards our project requirements though.
-Mike
Brian Woo wrote:
Hi,
I am looking for some sample code to implement a SAML-enabled server & client
with WSS4J. However, I can't seem to find any. I have tried the UsernameToken
example and it works fine, that's great. But, is WSS4J even ready for SAML? Or
it's still under development? Can someone give me some advice?
Thanks very much for your help,
Brian
======================================
Brian Woo
Regional Services, Engineering
SHAW ) Communications
Suite 800, 630 3rd Ave SW
Calgary AB, T2P 4L4
Phone: (403) 750-4648
---------------------------------------------------------------------
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]
---------------------------------------------------------------------
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]
