OpenSAML 2 to 3 migration, how to do an authentication redirect?

Question

I updated the OpenSAML dependency in my project from 2.6.5 to 3.3.0 and managed to migrate the most of my code including initialization of the library. The one only last method I am unable to migrate is the method responsible for authentication redirect. This is how it was implemented with OpenSAML 2:

private void doAuthenticationRedirect(HttpServletRequest request, HttpServletResponse response) throws Exception {
    AuthnRequest authnRequest = buildAuthnRequestObject();

    HttpServletResponseAdapter responseAdapter = new HttpServletResponseAdapter(response, true);

    responseAdapter.setStatusCode(HttpServletResponse.SC_MOVED_TEMPORARILY);

    SAMLMessageContext<?, AuthnRequest, ?> context = makeSamlMessageContext();

    XMLObjectBuilderFactory builderFactory = Configuration.getBuilderFactory();

    SAMLObjectBuilder<Endpoint> endpointBuilder = (SAMLObjectBuilder<Endpoint>) builderFactory
            .getBuilder(AssertionConsumerService.DEFAULT_ELEMENT_NAME);

    Endpoint samlEndpoint = endpointBuilder.buildObject();
    samlEndpoint.setLocation(dao.loadString((this.getClass().getName() + "_IDPRedirectURL")));

    String uuid = UUIDBuilder.createUUID().toString();
    context.setRelayState(uuid);

    context.setPeerEntityEndpoint(samlEndpoint);
    context.setOutboundSAMLMessage(authnRequest);
    context.setOutboundMessageTransport(responseAdapter);

    HTTPRedirectDeflateEncoder httpRedirectDeflateEncoder = new HTTPRedirectDeflateEncoder();
    httpRedirectDeflateEncoder.encode((MessageContext) context);
}

I am having a hard time migrating this because this part of the library seems to be refactored a lot, however, there is not much documentation about it out there. Message API Refactoring gives me some abstract information I cannot really apply in my particular case and I also cannot find any suitable examples. Can anybody give me any support on this task?

score 3 · Accepted Answer · answered Aug 20 '18 at 18:29

I took a shot at adapting your SAML code to work with OpenSAML v3. Hope this helps!

private void doAuthenticationRedirect(HttpServletRequest request, HttpServletResponse response) throws Exception {
  AuthnRequest authnRequest = buildAuthnRequestObject(); // assume this is your method

  // No response adapters needed anymore; the response now gets set directly on the encoder
  response.setStatus(HttpServletResponse.SC_MOVED_TEMPORARILY);

  // check your makeSamlMessageContext() method to see if any other properties on messageContext need to be set here
  MessageContext<SAMLObject> messageContext = new MessageContext<>();
  messageContext.setMessage(authnRequest);

  // This moved out of the Configuration class
  XMLObjectBuilderFactory builderFactory = XMLObjectProviderRegistrySupport.getBuilderFactory();

  SAMLObjectBuilder<Endpoint> endpointBuilder =
      (SAMLObjectBuilder<Endpoint>) builderFactory.getBuilder(AssertionConsumerService.DEFAULT_ELEMENT_NAME);

  Endpoint samlEndpoint = endpointBuilder.buildObject();
  samlEndpoint.setLocation(dao.loadString((this.getClass().getName() + "_IDPRedirectURL")));

  String uuid = UUIDBuilder.createUUID().toString(); // Assume this is your class

  // RelayState is now set via this helper method, or it can be performed via:
  // messageContext.getSubcontext(SAMLBindingContext.class, true).setRelayState(uuid);
  SAMLBindingSupport.setRelayState(messageContext, uuid);

  // Endpoint is now set via subcontexts
  SAMLPeerEntityContext peerEntityContext = messageContext.getSubcontext(SAMLPeerEntityContext.class, true);
  SAMLEndpointContext endpointContext = peerEntityContext.getSubcontext(SAMLEndpointContext.class, true);
  endpointContext.setEndpoint(samlEndpoint);

  // MessageContext and HttpServletResponse now get set directly on the encoder
  HTTPRedirectDeflateEncoder httpRedirectDeflateEncoder = new HTTPRedirectDeflateEncoder();
  httpRedirectDeflateEncoder.setMessageContext(messageContext);
  httpRedirectDeflateEncoder.setHttpServletResponse(response);
  httpRedirectDeflateEncoder.initialize();
  httpRedirectDeflateEncoder.encode();
}

Wow, thanks for such a huge effort! I'll need some time now to verify the solution and I will give you my feedback as soon as possible. — Danny Lo, Oct 22 '18 at 15:02

OpenSAML 2 to 3 migration, how to do an authentication redirect?

1 Answers1