As the post about signing SAML messages discussed, it is very important to properly sign and verify messages in a SAML federation. When verifying a signature of a message it is recommended to first validate the message with a SAML profile validator. This to ensure that the signature follows the standard for XML …

Some helpful examples of projects using OpenSAML

OpenSAML can be used to generate metadata. As with reading metadata, the library is pretty straight forward in relation to the metadata XML. This is an example for generating a SP metadata file We start by creating the EntityDescriptor, setting the EntityId and building the SSO descriptor. 1EntityDescriptor …

OpenSAML have several methods for reading and parsings SAML metadata. Meta data is loaded using providers. For example FilesystemMetadataProvider - Used to load data from a file on the filesystem HTTPMetadataProvider - Used to load data from an Internet address Here is an example on how to load meta data using the …

Creating SAML objects This is implementations of some of the methods in the SAMLUtil class referenced in other examples. OpenSAML has a bit struggling way to create SAML objects using a factory pattern. The normal way to create a SAML object is like this. 1XMLObjectBuilderFactory builderFactory = …

For all cryptographic functions OpenSAML requires a Credential which is a basically a cryptographic key wrapped in an object. The Credential can contain either an symmetric key or an asymmetric key not both. The Credential can be created manually with BasicX509Credential and BasicCredential classes and then populated …

In my case the, after the sign on at the IdP is completed, the user is redirected to my `Assertion Consumer Service URL defined in meta data. The IdP sends an artifact back as a parameter.The artifact is a label pointing to the actual user data/login information(the assertion) at the IdP. The user data is not sent in …

To logout an user from the SP an LogoutRequest is sent. The data needed about the user is the SessionIndex and NameID from the data recived at login. I my case in the Assertion in the Artifact Resolve Response. 1//IPR Ergogroup AS 2public static void doSynchronousLogout(final HttpSession sessionToLogout, final …

In this post I will show you how to start the SAML Single sign-on process by sending a authentication request using OpenSAML. The process starts with a redirect from the SP(The one wanting to authenticate someone) to the IdP(The one authenticating). To start the authentication the SP sends a SAML AuthnRequest as …