ws-wss4j-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Mike Smorul <>
Subject Re: SAML code samples...
Date Fri, 18 Nov 2005 23:17:23 GMT
SAML works, however if you want to use an external issuer, you will need 
to subclass WSDoallSender/Receiver to supply your own assertions to 
wss4j. Apart from that, SAML in wss4j is treated like a signed message.

Another issue that I ran into using SAML in wss4j is that for 
holder-of-key, you will need to check client assertions against message 
signing information manually. There is no check to make sure all 
signatures in the assertion match up, just that an assertion is present.

I have some stuff posted online that may be useful. It's 
mainly geared towards our project requirements though.


Brian Woo wrote:
> Hi,
> I am looking for some sample code to implement a SAML-enabled server & client with
WSS4J.  However, I can't seem to find any.  I have tried the UsernameToken example and it
works fine, that's great.  But, is WSS4J even ready for SAML?  Or it's still under development?
 Can someone give me some advice?
> Thanks very much for your help,
> Brian
> ======================================
> Brian Woo
> Regional Services, Engineering
> SHAW ) Communications
> Suite 800, 630 3rd Ave SW
> Calgary AB, T2P 4L4
> Phone: (403) 750-4648
> ---------------------------------------------------------------------
> To unsubscribe, e-mail:
> For additional commands, e-mail:

To unsubscribe, e-mail:
For additional commands, e-mail:

View raw message