使用SAML3进行OpenSAML断言验证

Question

我正在尝试使用OpenSAML 3验证SAMLResponse断言。链接：http://shibboleth.net/pipermail/dev/2016-November/008920.html

当我试图运行下面的代码时，我得到了一个异常

java.lang.ClassCastException: org.opensaml.ws.soap.soap11.impl.BodyBuilder cannot be cast to org.opensaml.core.xml.XMLObjectBuilder

这是在执行"InitializationService.initialize()“之后立即执行的。

   @PostConstruct
   public void init() {

    try {
      InitializationService.initialize();
      DocumentBuilderFactory documentBuilderFactory = 
      DocumentBuilderFactory.newInstance();
      documentBuilderFactory.setNamespaceAware(true);
      docBuilder = documentBuilderFactory.newDocumentBuilder();
      unmarshallerFactory = 
         XMLObjectProviderRegistrySupport.getUnmarshallerFactory();
      } catch (Exception e){
      logger.error("Error: ",e);
      }
   }

异常详细信息

java.lang.ClassCastException: org.opensaml.ws.soap.soap11.impl.BodyBuilder cannot be cast to org.opensaml.core.xml.XMLObjectBuilder
at org.opensaml.core.xml.config.XMLConfigurator.initializeObjectProviders(XMLConfigurator.java:238)
    at org.opensaml.core.xml.config.XMLConfigurator.load(XMLConfigurator.java:203)
    at org.opensaml.core.xml.config.XMLConfigurator.load(XMLConfigurator.java:188)
    at org.opensaml.core.xml.config.XMLConfigurator.load(XMLConfigurator.java:162)
    at org.opensaml.core.xml.config.AbstractXMLObjectProviderInitializer.init(AbstractXMLObjectProviderInitializer.java:52)
    at org.opensaml.core.config.InitializationService.initialize(InitializationService.java:56)

POM

下面是POM中考虑的依赖项

<dependency>
    <groupId>org.opensaml</groupId>
    <artifactId>xmltooling</artifactId>
    <version>1.4.4</version>
</dependency>

<dependency>
    <groupId>org.opensaml</groupId>
    <artifactId>opensaml-core</artifactId>
    <version>3.1.0</version>
</dependency>

<dependency>
    <groupId>org.opensaml</groupId>
    <artifactId>opensaml-saml-impl</artifactId>
    <version>3.2.0</version>
</dependency>

<dependency>
   <groupId>org.opensaml</groupId>
   <artifactId>opensaml-soap-api</artifactId>
   <version>3.3.0</version>
</dependency>

<dependency>
    <groupId>org.opensaml</groupId>
    <artifactId>opensaml-saml-api</artifactId>
    <version>3.3.0</version>
</dependency>
        
<dependency>
    <groupId>org.apache.santuario</groupId>
    <artifactId>xmlsec</artifactId>
    <version>2.0.7</version>
</dependency>
        
 <dependency>
    <groupId>org.apache.ant</groupId>
    <artifactId>ant</artifactId>
    <version>1.8.2</version>
</dependency>

感谢您在这方面的任何建议。谢谢

Answer 1

您需要从POM中删除xmltooling依赖项。它实际上是一个OpenSAML 2.0库，它会导致与您收到的冲突类似的冲突。

有关更多背景信息，请参阅本文中提供的OpenSAML issue和Pac4J issue (这是一个使用OpenSAML的Java库)。