Check for `opensaml` version on OpenSaml support classes

[marcusdacoregio]

It would be nice for users to know exactly which version of opensaml classes to use. A check could be performed in order to ensure that the correct version of opensaml is being used in the current OpenSamlX implementation.

One option would be to add the check inside the OpenSamlX constructors.

See:

• OpenSaml4LogoutRequestResolver calls setIssueInstant with wrong type #10547

[igorpele]

Hi, I would like to try this.
As far as I could see there is already a version check in the Saml2LoginConfigurer and Saml2LogoutConfigurer.
Additionally it should be checked in the according OpenSaml4LoginRequestResolver or OpenSaml4LoginRequestResolver (and all the other OpenSaml3... and OpenSaml4... classes) whether the correct version of opensaml is in the classpath?

[marcusdacoregio]

Hi @igorpele, thanks for the interest. The ticket is yours.

Yes, I can think of creating a util class to retrieve the version, like it's being done in Saml2LoginConfigurer and Saml2LogoutConfigurer.

And inside of each of those constructors, you should verify if the version starts with 3 or 4. And for the SAML 2.0 Logout classes, the minimum version should be 4.1 as per #10547 (comment).

Please, feel free to keep discussing if it's not crystal clear yet.

[igorpele]

Hi @marcusdacoregio, thanks for the hints.
Is SAML2 SSO supported with OpenSAML version 4.0.1 as it throws an Exception in the OpenSaml4AuthenticationProvider as already mentioned in #10547?
The OpenSaml4LogoutRequestResolver and OpenSaml4LogoutResponseResolver will after this change only work with versions >= 4.1.0, but should this also be true for the OpenSaml4AuthenticationProvider?

[marcusdacoregio]

Is SAML2 SSO supported with OpenSAML version 4.0.1 as it throws an Exception in the OpenSaml4AuthenticationProvider as already mentioned in #10547?

I think we have to check if SSO is working with version 4.0.1, if not the minimum version should be 4.1.x then.

The OpenSaml4LogoutRequestResolver and OpenSaml4LogoutResponseResolver will after this change only work with versions >= 4.1.0, but should this also be true for the OpenSaml4AuthenticationProvider?

Nice question, I think we can force the minimum version for all OpenSaml4 classes to be 4.1.x to keep consistency and avoid having multiple minor versions around. I'd like to see if @jzheaux has some input on this as well.