swedenconnect / opensaml-addons Goto Github PK

We should include access to the Response object from ResponseStatusErrorException.

Currently, when a template object is supplied it is cloned. This leads to that the builder can not be used to modify an existing object. Introduce a possibility to not clone the template ...

In OpenSAML 5 there is a change in XMLObjectSupport.cloneXMLObject where null isn't accepted. We must guard against that.

The checkReplay(SAMLObject) in both MessageReplayChecker implementations does not handle authentication requests.

Bug!

In some cases we need to put together the redirect URL ourselves.

The ResponseProcessingInput interface defines the method getAuthnRequest(). This will only work if the AuthnRequest is saved in a session. If it is written to a database or cache, we can't find it unless we get the ID.

Solution: Declare getAuthnRequest(final String id) instead.

We don't want that.

Be more forgiving

OpenSAML 5 is here and we will introduce this dependency.

In the ResponseValidator we need to use a more forgiving comparison when checking the Destination attribute against the URL on which the response was received. Especially in test environments there may be a problem when comparing URLs.

Currently it is only possible to verify signatures using the default system security configuration. We need to make this configurable.

We need to add a getResponse method to ResponseProcessingResult. It is needed in some cases (logging, etc).

In cases where we want to use a CompositeMetadataProvider as a metadata aggregator from several sources there should be a way to preserve the validUntil and cacheDuration from the underlying providers.

So, set the validUntil and cacheDuration to the shortest value from all underlying providers.

If an object is found the time check is fawlty.

We have a number of abstract classes and templates for AuthnRequestGenerator and its input. Let's make that more simple.

Response ID and InResponseTo should be set.

We need to be able to configure the AbstractMetadataContainer classes concerning how metadata is signed.

Add utility to aid serializing of OpenSAML objects

For logging and health checks we may want to access each individual provider in a CompositeMetadataProvider instance. Therefore we should add the getProviders() method.

Implement MetadataProvider and MetadataResolver supporting MDQ.

After copying some code from OpenSAML's HTTPPostEncoder implementation I see that we use HTMLEncoder.encodeForHTMLAttribute to encode the RelayState. This may be correct for the OpenSAML implementation since it supplies data to Velocity, but for us it is wrong. In fact, it is better not to encode the parameters at all.

ResponseStatusErrorException should include issuer of response.

We need to add support for the Holder-of-key profile.