HttpMetadataProvider replacement in opensaml 3

user_3922168 0
Viewed 129

We were using opensaml2.6.5 along with commons-httpclient3.1. However, there is critical vulnerability in commons-httpclient and it is suggested to upgrade to httpclient4.5.13. This version has lot of changes including HttpClient class. Earlier this was in org.apache.commons.httpclient package. Now it is in org.apache.http.client package.

In opensaml2.6.5, there are classes which uses older version of HttpClient. So, after upgrade, few classes cannot accept new class as input parameter. Couple of opensaml classes that has problem are org.opensaml.saml2.metadata.provider.HTTPMetadataProvider and org.opensaml.saml2.metadata.provider.FileBackedHTTPMetadataProvider. What is the replacement for these classes in Opensaml 3?

opensaml java
1 Answers

In OpenSAML 3 and 4 these are replaced by org.opensaml.saml.metadata.resolver.impl.HTTPMetadataResolver and org.opensaml.saml.metadata.resolver.impl.FileBackedHTTPMetadataResolver

It is not always easy to used the resolvers in the new API. Here are some good examples for using metadata and credential resolvers. Signing and verifying signatures with OpenSAML 4

user_3108520
Related