swedenconnect / opensaml-swedish-eid

OpenSAML extensions for the Swedish eID Framework

opensaml-swedish-eid

OpenSAML extensions for the Swedish eID Framework

--

This open source package is an extension to OpenSAML that offers interfaces and classes for the Swedish eID Framework, see https://github.com/swedenconnect/technical-framework.

The library contains support for the following functionality:

• Attribute definitions according to the Attribute Specification for the Swedish eID Framework specification.

• Mapping of level of assurance URI:s as defined by the Swedish eID Framework (Swedish eID Framework - Registry for identifiers).

• Representation of entity categories as defined in the Entity Categories for the Swedish eID Framework specification.

• Support for the SignMessage extension type, including utility classes for building sign message extensions and for decrypting sign messages. See the DSS Extension for Federated Central Signing Services specification.

• Support for the SADRequest extension type as well as the SAD JWT. The SAD support also includes a SAD factory for creating and signing a SAD JWT and a SAD parser with validation support. See the Signature Activation Protocol for Federated Signing specification.

• Support for the PrincipalSelection extension type that allows a requester to include a hint about the person that is about to be authenticated (especially useful for signature services). See the Principal Selection in SAML Authentication Requests specification.

• Support for the UserMessage extension type that allows a Service Provider to include a dynamic message for the user to see during the authentication phase. See the User Message Extension in SAML Authentication Requests specification.

• Validation support for validating SAML responses according to the Deployment Profile for the Swedish eID Framework specification.

API Documentation

Java API documentation of the opensaml-swedish-eid library is found at https://docs.swedenconnect.se/opensaml-swedish-eid/apidoc.

Maven

The opensaml-swedish-eid project artifacts are published to Maven central.

Include the following snippet in your Maven POM to add opensaml-swedish-eid as a dependency for your project.

<dependency>
  <groupId>se.swedenconnect.opensaml</groupId>
  <artifactId>opensaml-swedish-eid</artifactId>
  <version>${opensaml-swedish-eid.version}</version>
</dependency>

---

Copyright © 2016-2024, Sweden Connect. Licensed under version 2.0 of the Apache License.

opensaml-swedish-eid's Issues

Implement support for UserMessage extension

See swedenconnect/technical-framework#213

SAD issue time check lacks time skew tolerance configuration

From Stefan Santesson:

The SADValidator at se.swedenconnect.opensaml.sweid.saml2.signservice.SADParser.SADValidator has a problem in the check of issue time at row 200

The current check: (long)sad.getIssuedAt() > now

This check does not allow any time skew. If the sign server clock is behind the IdP clock by just a few seconds, this check will fail. In test environments this will fail if time skew is a fraction of a second.

This check should have a configurable time skew margin.

Changes due to removed HoK-requirement for LoA4

Holder-of-key is no longer a hard requirement for LoA4. Updates that reflect this will be needed.

Make it possible to specify user id attribute dynamically for SADBuilder

Currently, the SADFactory needs to be pre-configured with an attribute name for this ...

Make EntityCategory serializable

Make EntityCategory and all of its subclasses serializable.

Port to OpenSAML 5

Port to OpenSAML 5

Pawload in SAD-attributes are not compact encoded

We should fix so that the SAD-payload isn't padding (according to the specs).

Add support for Holder-of-key subject confirmation validator

The Swedish eID framework has support for the HoK-profile so we should add a subject confirmation validator for HoK.

Bug in SwedishEidAssertionValidationParametersBuilder

If AddressRequired is not set we get a NPE.