Opensaml v4 3 2 1 #33207

karel-harjono · 2025-10-23T20:41:08Z

I have considered the risk of behavior change or other zero migration impact (https://github.com/OpenLiberty/open-liberty/wiki/Behavior-Changes).
If this PR fixes an Issue, the description includes "Fixes #FILLMEIN" or "Resolves #FILLMEIN" (verify release bug label if applicable: https://github.com/OpenLiberty/open-liberty/wiki/Open-Liberty-Conventions).
If this PR resolves an external Known Issue (including APARS), the description includes "Fixes #FILLMEIN" or "Resolves #FILLMEIN".

…Algorithm

…key encryption between idp and sp

… StaticKeyInfoCredentialResolver when LocalKeyInfoCredentialResolver fails

…h test

…dates

karel-harjono · 2025-10-23T20:41:25Z

!build (view Open Liberty Personal Build - ❌ completed with errors/failures.)

Note: Target locations of links might be accessible only to IBM employees.

ramkumar-k-9286

Approve ID changes

karel-harjono · 2025-10-24T20:11:58Z

!build
(view Open Liberty Personal Build - ❌ completed with errors/failures.)
spawn.fullfat.buckets=com.ibm.ws.security.saml.sso_fat, com.ibm.ws.security.saml.sso_fat.2, com.ibm.ws.security.saml.sso_fat.3, com.ibm.ws.security.saml.sso_fat.config, com.ibm.ws.security.saml.sso_fat.config.mapToUserRegistry, com.ibm.ws.security.saml.sso_fat.endpoint.samlmetadata, com.ibm.ws.security.saml.sso_fat.jaxrs, com.ibm.ws.security.saml.sso_fat.jaxrs.config, com.ibm.ws.security.saml.sso_fat.logout, com.ibm.ws.security.saml.sso_fat.logout.IDP_initiated, com.ibm.ws.security.saml.sso_fat.logout.httpServletRequest, com.ibm.ws.security.saml.sso_fat.logout.ibm_security_logout, com.ibm.ws.wssecurity_fat.wsscxf.saml.1, com.ibm.ws.wssecurity_fat.wsscxf.saml.2, com.ibm.ws.wssecurity_fat.wsscxf.saml.3, com.ibm.ws.wssecurity_fat.wsscxf.saml.5, com.ibm.ws.wssecurity_fat.wsscxf.saml.6, io.openliberty.jcache.internal_fat.hazelcast,io.openliberty.jcache.internal_fat.infinispan, com.ibm.ws.security.oidc.client_fat.backchannelLogout.saml.1, com.ibm.ws.security.oidc.client_fat.backchannelLogout.saml.2, com.ibm.ws.security.oidc.client_fat.saml, com.ibm.ws.security.oidc.server_fat.saml,com.ibm.ws.wssecurity_fat.wsscxf.1, com.ibm.ws.wssecurity_fat.wsscxf.2, com.ibm.ws.wssecurity_fat.wsscxf.3, com.ibm.ws.wssecurity_fat.wsscxf.4

Note: Target locations of links might be accessible only to IBM employees.

karel-harjono · 2025-10-24T20:13:12Z

!build (view Open Liberty Personal Build - ❌ completed with errors/failures.)

Note: Target locations of links might be accessible only to IBM employees.

LibbyBot · 2025-10-24T20:19:21Z

Code analysis and actions

DO NOT DELETE THIS COMMENT.

39 FAT files were changed, added, or removed.
Check that the build did not break the affected FAT suite(s).
2 infrastructure code files were changed.
16 test infrastructure code files were changed.
Test failures/errors in the build could be due to these changes.
65 product code files were changed.
Please describe in a separate comment how you tested your changes.
1 NLS files were changed and need an ID review.
@OpenLiberty/message-reviewer Please review.
- dev/com.ibm.ws.security.saml.websso.2.0/resources/OSGI-INF/l10n/metatype.properties

LibbyBot · 2025-10-24T20:20:26Z

DHE Server Artifacts Check:

🚨 Failed to locate the artifact's JAR and/or POM at the following location(s):🚨

LibbyBot · 2025-10-24T20:21:00Z

Code analysis and actions

DO NOT DELETE THIS COMMENT.

39 FAT files were changed, added, or removed.
Check that the build did not break the affected FAT suite(s).
2 infrastructure code files were changed.
16 test infrastructure code files were changed.
Test failures/errors in the build could be due to these changes.
65 product code files were changed.
Please describe in a separate comment how you tested your changes.
1 NLS files were changed and need an ID review.
@OpenLiberty/message-reviewer Please review.
- dev/com.ibm.ws.security.saml.websso.2.0/resources/OSGI-INF/l10n/metatype.properties

LibbyBot · 2025-10-24T20:21:12Z

DHE Server Artifacts Check:

🚨 Failed to locate the artifact's JAR and/or POM at the following location(s):🚨

Test saml Changes

Zech-Hein · 2025-10-25T06:27:07Z

!build
(view Open Liberty Personal Build - ❌ completed with errors/failures.)
spawn.fullfat.buckets=com.ibm.ws.security.saml.sso_fat, com.ibm.ws.security.saml.sso_fat.2, com.ibm.ws.security.saml.sso_fat.3, com.ibm.ws.security.saml.sso_fat.config, com.ibm.ws.security.saml.sso_fat.config.mapToUserRegistry, com.ibm.ws.security.saml.sso_fat.endpoint.samlmetadata, com.ibm.ws.security.saml.sso_fat.jaxrs, com.ibm.ws.security.saml.sso_fat.jaxrs.config, com.ibm.ws.security.saml.sso_fat.logout, com.ibm.ws.security.saml.sso_fat.logout.IDP_initiated, com.ibm.ws.security.saml.sso_fat.logout.httpServletRequest, com.ibm.ws.security.saml.sso_fat.logout.ibm_security_logout, com.ibm.ws.wssecurity_fat.wsscxf.saml.1, com.ibm.ws.wssecurity_fat.wsscxf.saml.2, com.ibm.ws.wssecurity_fat.wsscxf.saml.3, com.ibm.ws.wssecurity_fat.wsscxf.saml.5, com.ibm.ws.wssecurity_fat.wsscxf.saml.6, io.openliberty.jcache.internal_fat.hazelcast,io.openliberty.jcache.internal_fat.infinispan, com.ibm.ws.security.oidc.client_fat.backchannelLogout.saml.1, com.ibm.ws.security.oidc.client_fat.backchannelLogout.saml.2, com.ibm.ws.security.oidc.client_fat.saml, com.ibm.ws.security.oidc.server_fat.saml,com.ibm.ws.wssecurity_fat.wsscxf.1, com.ibm.ws.wssecurity_fat.wsscxf.2, com.ibm.ws.wssecurity_fat.wsscxf.3, com.ibm.ws.wssecurity_fat.wsscxf.4

Note: Target locations of links might be accessible only to IBM employees.

LibbyBot · 2025-10-25T06:34:33Z

Code analysis and actions

DO NOT DELETE THIS COMMENT.

39 FAT files were changed, added, or removed.
Check that the build did not break the affected FAT suite(s).
3 infrastructure code files were changed.
16 test infrastructure code files were changed.
Test failures/errors in the build could be due to these changes.
70 product code files were changed.
Please describe in a separate comment how you tested your changes.
1 NLS files were changed and need an ID review.
@OpenLiberty/message-reviewer Please review.
- dev/com.ibm.ws.security.saml.websso.2.0/resources/OSGI-INF/l10n/metatype.properties

LibbyBot · 2025-10-25T06:34:53Z

The following files contain a string in its header indicating IBM copyrighted content:

dev/com.ibm.ws.org.ehcache.ehcache.107.3.8.1/src/org/ehcache/impl/persistence/FileUtils.java

LibbyBot · 2025-10-25T06:35:03Z

DHE Server Artifacts Check:

🚨 Failed to locate the artifact's JAR and/or POM at the following location(s):🚨

…SAMismatch expectations

Zech-Hein · 2025-10-25T20:12:49Z

!build
(view Open Liberty Personal Build - ❌ completed with errors/failures.)
spawn.fullfat.buckets=com.ibm.ws.security.saml.sso_fat, com.ibm.ws.security.saml.sso_fat.2, com.ibm.ws.security.saml.sso_fat.3, com.ibm.ws.security.saml.sso_fat.config, com.ibm.ws.security.saml.sso_fat.config.mapToUserRegistry, com.ibm.ws.security.saml.sso_fat.endpoint.samlmetadata, com.ibm.ws.security.saml.sso_fat.jaxrs, com.ibm.ws.security.saml.sso_fat.jaxrs.config, com.ibm.ws.security.saml.sso_fat.logout, com.ibm.ws.security.saml.sso_fat.logout.IDP_initiated, com.ibm.ws.security.saml.sso_fat.logout.httpServletRequest, com.ibm.ws.security.saml.sso_fat.logout.ibm_security_logout, com.ibm.ws.wssecurity_fat.wsscxf.saml.1, com.ibm.ws.wssecurity_fat.wsscxf.saml.2, com.ibm.ws.wssecurity_fat.wsscxf.saml.3, com.ibm.ws.wssecurity_fat.wsscxf.saml.5, com.ibm.ws.wssecurity_fat.wsscxf.saml.6, io.openliberty.jcache.internal_fat.hazelcast,io.openliberty.jcache.internal_fat.infinispan, com.ibm.ws.security.oidc.client_fat.backchannelLogout.saml.1, com.ibm.ws.security.oidc.client_fat.backchannelLogout.saml.2, com.ibm.ws.security.oidc.client_fat.saml, com.ibm.ws.security.oidc.server_fat.saml,com.ibm.ws.wssecurity_fat.wsscxf.1, com.ibm.ws.wssecurity_fat.wsscxf.2, com.ibm.ws.wssecurity_fat.wsscxf.3, com.ibm.ws.wssecurity_fat.wsscxf.4

Note: Target locations of links might be accessible only to IBM employees.

LibbyBot · 2025-10-25T20:20:27Z

The following files contain a string in its header indicating IBM copyrighted content:

dev/com.ibm.ws.org.ehcache.ehcache.107.3.8.1/src/org/ehcache/impl/persistence/FileUtils.java

LibbyBot · 2025-10-25T20:20:42Z

Code analysis and actions

DO NOT DELETE THIS COMMENT.

40 FAT files were changed, added, or removed.
Check that the build did not break the affected FAT suite(s).
3 infrastructure code files were changed.
16 test infrastructure code files were changed.
Test failures/errors in the build could be due to these changes.
70 product code files were changed.
Please describe in a separate comment how you tested your changes.
1 NLS files were changed and need an ID review.
@OpenLiberty/message-reviewer Please review.
- dev/com.ibm.ws.security.saml.websso.2.0/resources/OSGI-INF/l10n/metatype.properties

LibbyBot · 2025-10-25T20:20:49Z

DHE Server Artifacts Check:

🚨 Failed to locate the artifact's JAR and/or POM at the following location(s):🚨

Karel Harjono and others added 29 commits October 21, 2025 15:50

add ECDSA tests onto sso.2 fat

8435660

add support for ECDSA saml signing algo

6745ae5

update ecdsa_sha256 with sha256 flag in test server configs

312dac0

fix unit tests for ecdsa signature update

3e062f1

add ECDSAwithSHA256 signatureMethodAlgorithm support

bed407e

add ECDSA signature tests with signatureMethodAlgorithm SHA256

e4f86f8

fix SignatureMethod evaluate ECDSA to be stronger than RSA

470d20a

update SignatureMethods to evalute ECDSA stronger than RSA

6e6a8bd

add SHA384 SHA512 ECDSAWithSHA384 ECDSAWithSHA512 for signatureMethod…

b58a42a

…Algorithm

add new test to use aes keywrap and EC-DH key agreement for data and …

b5324e4

…key encryption between idp and sp

Skip EC-DH encryption algorithm for ecdsa rsaIdp test

e6de474

fix failing negative test case using unsuccessfulFlow method

acf1fc9

opensaml v4 update (1)

8207347

opensaml v4 updates (2)

a432af6

support ecdh keywrapping in saml websso feature

d3ab32d

ecdh support in saml websso (2)

75e87ec

saml websso test with keyagreement configuration

44a9422

fix unit tests for opensaml v4 upgrade

71b504b

add new test to use aes keywrap and EC-DH key agreement for data and …

04ce534

…key encryption between idp and sp

remove curves that are not supported

3e32e8a

fix(regression): use ChainingKeyInfoCredentialResolver to fallback to…

c5db89d

… StaticKeyInfoCredentialResolver when LocalKeyInfoCredentialResolver fails

fix opensaml javax.annotation version problem

a84ee7e

fix(fat): added missing test xmls and web servlet mapping for new ecd…

eba13f4

…h test

allow invalid key exception ffdc for negative decryption tests(2)

e87fcf9

specify java.xml.soap version 1.3 for java 8

a355ad0

add new io.openliberty opensaml jars

d00875e

fix javax.xml.soap min version for jdk8

b08912d

add allowedffdc for invalidKeyException on jdk8 due to opensaml v4 up…

fb00445

…dates

fix expectedFFDC typo

c7f01fa

opensaml 4321 jar version updates

3c344c0

ramkumar-k-9286 added ID reviewed and removed ID waiting on development labels Oct 24, 2025

ramkumar-k-9286 previously approved these changes Oct 24, 2025

View reviewed changes

Zech-Hein dismissed ramkumar-k-9286’s stale review via 4124c67 October 24, 2025 20:00

Remove overlays and switch to OL Forks

f325041

Test saml Changes

Zech-Hein force-pushed the opensaml-v4_3_2_1 branch from 4124c67 to f325041 Compare October 25, 2025 06:24

Zech-Hein added 2 commits October 25, 2025 13:28

fix testEncryptionAlgorithm_AES128_RSAKey_signatureMethodAlgorithmECD…

ad76ced

…SAMismatch expectations

update testCxfUntHardcodedReplayOneAndMoreMinutesSSL to expect replay

1672e83

Zech-Hein force-pushed the opensaml-v4_3_2_1 branch from 25f3b0a to 1672e83 Compare October 25, 2025 20:12

Zech-Hein requested a review from arkarkala October 25, 2025 20:20

Zech-Hein assigned Zech-Hein and karel-harjono Oct 25, 2025

Zech-Hein assigned neuwerk Oct 25, 2025

Zech-Hein added team:Security SSO FIPS140-3 labels Oct 25, 2025

Opensaml v4 3 2 1 #33207

Are you sure you want to change the base?

Opensaml v4 3 2 1 #33207

Conversation

karel-harjono commented Oct 23, 2025

Uh oh!

karel-harjono commented Oct 23, 2025 • edited by LibbyBot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ramkumar-k-9286 left a comment

Choose a reason for hiding this comment

Uh oh!

karel-harjono commented Oct 24, 2025 • edited by LibbyBot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

karel-harjono commented Oct 24, 2025 • edited by LibbyBot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

LibbyBot commented Oct 24, 2025

Code analysis and actions

Uh oh!

LibbyBot commented Oct 24, 2025

Uh oh!

LibbyBot commented Oct 24, 2025

Code analysis and actions

Uh oh!

LibbyBot commented Oct 24, 2025

Uh oh!

Zech-Hein commented Oct 25, 2025 • edited by LibbyBot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

LibbyBot commented Oct 25, 2025

Code analysis and actions

Uh oh!

LibbyBot commented Oct 25, 2025

Uh oh!

LibbyBot commented Oct 25, 2025

Uh oh!

Zech-Hein commented Oct 25, 2025 • edited by LibbyBot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

LibbyBot commented Oct 25, 2025

Uh oh!

LibbyBot commented Oct 25, 2025

Code analysis and actions

Uh oh!

LibbyBot commented Oct 25, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

karel-harjono commented Oct 23, 2025 •

edited by LibbyBot

Loading

karel-harjono commented Oct 24, 2025 •

edited by LibbyBot

Loading

karel-harjono commented Oct 24, 2025 •

edited by LibbyBot

Loading

Zech-Hein commented Oct 25, 2025 •

edited by LibbyBot

Loading

Zech-Hein commented Oct 25, 2025 •

edited by LibbyBot

Loading