使用 OpenSAML 3 的 SAML 断言验证

Question

我试图使用 OpenSAML 3 验证 SAMLResponse 断言。链接： http ://shibboleth.net/pipermail/dev/2016-November/008920.html

当我尝试运行以下代码时，出现异常

java.lang.ClassCastException: org.opensaml.ws.soap.soap11.impl.BodyBuilder cannot be cast to org.opensaml.core.xml.XMLObjectBuilder

这是在执行“InitializationService.initialize()”之后立即执行的。

   @PostConstruct
   public void init() {

    try {
      InitializationService.initialize();
      DocumentBuilderFactory documentBuilderFactory = 
      DocumentBuilderFactory.newInstance();
      documentBuilderFactory.setNamespaceAware(true);
      docBuilder = documentBuilderFactory.newDocumentBuilder();
      unmarshallerFactory = 
         XMLObjectProviderRegistrySupport.getUnmarshallerFactory();
      } catch (Exception e){
      logger.error("Error: ",e);
      }
   }

异常详情

java.lang.ClassCastException: org.opensaml.ws.soap.soap11.impl.BodyBuilder cannot be cast to org.opensaml.core.xml.XMLObjectBuilder
at org.opensaml.core.xml.config.XMLConfigurator.initializeObjectProviders(XMLConfigurator.java:238)
    at org.opensaml.core.xml.config.XMLConfigurator.load(XMLConfigurator.java:203)
    at org.opensaml.core.xml.config.XMLConfigurator.load(XMLConfigurator.java:188)
    at org.opensaml.core.xml.config.XMLConfigurator.load(XMLConfigurator.java:162)
    at org.opensaml.core.xml.config.AbstractXMLObjectProviderInitializer.init(AbstractXMLObjectProviderInitializer.java:52)
    at org.opensaml.core.config.InitializationService.initialize(InitializationService.java:56)

聚甲醛

以下是 POM 中考虑的依赖项

<dependency>
    <groupId>org.opensaml</groupId>
    <artifactId>xmltooling</artifactId>
    <version>1.4.4</version>
</dependency>

<dependency>
    <groupId>org.opensaml</groupId>
    <artifactId>opensaml-core</artifactId>
    <version>3.1.0</version>
</dependency>

<dependency>
    <groupId>org.opensaml</groupId>
    <artifactId>opensaml-saml-impl</artifactId>
    <version>3.2.0</version>
</dependency>

<dependency>
   <groupId>org.opensaml</groupId>
   <artifactId>opensaml-soap-api</artifactId>
   <version>3.3.0</version>
</dependency>

<dependency>
    <groupId>org.opensaml</groupId>
    <artifactId>opensaml-saml-api</artifactId>
    <version>3.3.0</version>
</dependency>
        
<dependency>
    <groupId>org.apache.santuario</groupId>
    <artifactId>xmlsec</artifactId>
    <version>2.0.7</version>
</dependency>
        
 <dependency>
    <groupId>org.apache.ant</groupId>
    <artifactId>ant</artifactId>
    <version>1.8.2</version>
</dependency>

---

感谢任何关于此的指针。 谢谢

Answer 1

您需要从 POM 中删除 xmltooling 依赖项。 它实际上是一个 OpenSAML 2.0 库，它会导致像您收到的那样的冲突。

欲了解更多背景细节，看到一个OpenSAML问题对已经在本申请和Pac4J问题（这是使用OpenSAML一个Java库）。