Generating metadata with OpenSAML

OpenSAML can be used to generate metadata. As with reading, the framework is pretty straight forward in relation to the metadata XML.

This is an example for generating a SP metadata file

We start by creating the EntityDescriptor, setting the EntityId and building the SSO descriptor.

EntityDescriptor spEntityDescriptor = SAMLUtil.buildSAMLObjectWithDefaultName(EntityDescriptor.class);
spEntityDescriptor.setEntityID(entityID);
SPSSODescriptor spSSODescriptor = SAMLUtil.buildSAMLObjectWithDefaultName(SPSSODescriptor.class);

In the SSO descriptor we request how we want the communication signed and encrypted

spSSODescriptor.setWantAssertionsSigned(true); spSSODescriptor.setAuthnRequestsSigned(true);

And what certificates we want to use

X509KeyInfoGeneratorFactory keyInfoGeneratorFactory = new X509KeyInfoGeneratorFactory();
keyInfoGeneratorFactory.setEmitEntityCertificate(true);
KeyInfoGenerator keyInfoGenerator = keyInfoGeneratorFactory.newInstance();

  
KeyDescriptor encKeyDescriptor = SAMLUtil.buildSAMLObjectWithDefaultName(KeyDescriptor.class);

encKeyDescriptor.setUse(UsageType.ENCRYPTION); //Set usage

// Generating key info. The element will contain the public key. The key is used to by the IDP to encrypt data
try {
 encKeyDescriptor.setKeyInfo(keyInfoGenerator.generate(X509Credential));
} catch (SecurityException e) {
 log.error(e.getMessage(), e);
}

spSSODescriptor.getKeyDescriptors().add(encKeyDescriptor);
  
KeyDescriptor signKeyDescriptor = SAMLUtil.buildSAMLObjectWithDefaultName(KeyDescriptor.class);

signKeyDescriptor.setUse(UsageType.SIGNING);  //Set usage

// Generating key info. The element will contain the public key. The key is used to by the IDP to verify signatures
try {
 signKeyDescriptor.setKeyInfo(keyInfoGenerator.generate(X509Credential));
} catch (SecurityException e) {
 log.error(e.getMessage(), e);
}

spSSODescriptor.getKeyDescriptors().add(signKeyDescriptor);

The keyInfoGenerator uses a X509Credential to generate the key info object with the public key.


Setting what type of pseudonym federation we want with the IDP.

// Request transient pseudonym
NameIDFormat nameIDFormat = SAMLUtil.buildSAMLObjectWithDefaultName(NameIDFormat.class);
nameIDFormat.setFormat("urn:oasis:names:tc:SAML:2.0:nameid-format:transient");
spSSODescriptor.getNameIDFormats().add(nameIDFormat);

Setting location of services

AssertionConsumerService assertionConsumerService = SAMLUtil.buildSAMLObjectWithDefaultName(AssertionConsumerService.class);
assertionConsumerService.setIndex(0);
assertionConsumerService.setBinding(SAMLConstants.SAML2_ARTIFACT_BINDING_URI);

// Setting address for our AssertionConsumerService
assertionConsumerService.setLocation(assertionConsumerServiceURL);
spSSODescriptor.getAssertionConsumerServices().add(assertionConsumerService);

And finally we set SAML as supported protocol and generate the XML

spSSODescriptor.addSupportedProtocol(SAMLConstants.SAML20P_NS);

spEntityDescriptor.getRoleDescriptors().add(spSSODescriptor);

DocumentBuilder builder;
DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();

builder = factory.newDocumentBuilder();
Document document = builder.newDocument();
Marshaller out = Configuration.getMarshallerFactory().getMarshaller(spEntityDescriptor);
out.marshall(spEntityDescriptor, document);

Transformer transformer = TransformerFactory.newInstance().newTransformer();
StringWriter stringWriter = new StringWriter();
StreamResult streamResult = new StreamResult(stringWriter);
DOMSource source = new DOMSource(document);
transformer.transform(source, streamResult);
stringWriter.close();
String metadataXML = stringWriter.toString();