title: How to validate WS-Federation SAML tokens with Java Service Provider
body: <p>I am working on a project that uses ws_federation and SAML to authenticate to a Identity Provider running on a IIS server running on .net called <a href="http://www.thinktecture.com/" rel="noreferrer">thinktecture</a></p>
  
  <p>I need to write a Java Service Provider that sends a SAML authentication request to the Identity Provider and get the SAML response back on my java web app.</p>
  
  <p>I need to know if there are any good libraries to validate SAML and mabye some direction on setting it up or links to a tutorial on getting started. I have tries spring_security-saml_extensions, but I keep getting errors when I try to put my Identitiy Providers meta-data link into the config files.</p>
  
  <p>Any help would be greatly appreciated!</p>
  
  <p>Also: It would be great if the solution could be integrated into an existing java web application!</p>
  
  <p>Some Additional info:</p>
  
  <p>Below is the XML I can get from the response returned by the IDP in my SP I am working on I was under the impression that this was a SAML token.</p>
  
  <pre><code>&lt;trust:RequestSecurityTokenResponseCollection xmlns:trust="http://docs.oasis-open.org/ws-sx/ws-trust/200512"&gt;
  &lt;trust:RequestSecurityTokenResponse Context="rm=0&amp;amp;id=passive&amp;amp;ru=%2fApplicant%2fMyAccount%2fHome"&gt;
      &lt;trust:Lifetime&gt;
          &lt;wsu:Created xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"&gt;2013-04-17T19:37:18.399Z&lt;/wsu:Created&gt;
          &lt;wsu:Expires xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"&gt;2013-04-17T20:07:18.399Z&lt;/wsu:Expires&gt;
      &lt;/trust:Lifetime&gt;
      &lt;wsp:AppliesTo xmlns:wsp="http://schemas.xmlsoap.org/ws/2004/09/policy"&gt;
          &lt;wsa:EndpointReference xmlns:wsa="http://www.w3.org/2005/08/addressing"&gt;
              &lt;wsa:Address&gt;https://[SP Server]/&lt;/wsa:Address&gt;
          &lt;/wsa:EndpointReference&gt;
      &lt;/wsp:AppliesTo&gt;
      &lt;trust:RequestedSecurityToken&gt;
          &lt;Assertion ID="_b4c87094-9557-419f-92fd-714a2b9cd8af" IssueInstant="2013-04-17T19:37:18.399Z" Version="2.0" xmlns="urn:oasis:names:tc:SAML:2.0:assertion"&gt;
              &lt;Issuer&gt;http://[IDP Server]/trust/idp&lt;/Issuer&gt;
              &lt;Signature xmlns="http://www.w3.org/2000/09/xmldsig#"&gt;
                  &lt;SignedInfo&gt;
                      &lt;CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /&gt;
                      &lt;SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256" /&gt;
                      &lt;Reference URI="#_b4c87094-9557-419f-92fd-714a2b9cd8af"&gt;
                          &lt;Transforms&gt;
                              &lt;Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /&gt;
                              &lt;Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /&gt;
                          &lt;/Transforms&gt;
                          &lt;DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256" /&gt;
                          &lt;DigestValue&gt;pVpyzVN6Cz7NRNsp+jSVQP4ILt1J8y/4KBPzAtbllMg=&lt;/DigestValue&gt;
                      &lt;/Reference&gt;
                  &lt;/SignedInfo&gt;
                  &lt;SignatureValue&gt;NnTCfQE7p1FmrdbmYk+wRpbaZ5Rr4Opk67mI2Y6+PTdQlUErv5Bt8C/iBA398CwAgZyREqZfobd47QnxZYOvnFjiMSsQAndmPejZ9PEGwdu8hVrYyhV2VpcPtcaew/tOGWBvTdUKH5YjGmTHLtLxny0WaGYIquYVWoO3S68duy6DWXr/rxMzOEjNhY3s/3alCYMSYqDrhB8jKY8M9M2jruZa2KjIziumW6bzksizYSEFAcn4LfVhACaucrBAVch+r31vKAxO0BpkU7wSRBTaQV+/ALmA1HJAVO/mecujHJnhpizF4GDNdsnbIxck3r/2X9gt7WgMhfwBW+6Xvd2whQ==&lt;/SignatureValue&gt;
                  &lt;KeyInfo&gt;
                      &lt;X509Data&gt;
                          &lt;X509Certificate&gt;MIIC5TCCAc2gAwIBAgIQSuU/gl5tP49ARSN2SkVRKzANBgkqhkiG9w0BAQUFADAaMRgwFgYDVQQDEw9XTVN2Yy1VU0FKLURFVjEwHhcNMTAxMDAxMTI1MjUxWhcNMjAwOTI4MTI1MjUxWjAaMRgwFgYDVQQDEw9XTVN2Yy1VU0FKLURFVjEwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCgytRM5b2B35ydz+zxt59fklaT02z4AXUd9zm3h7Clq8LZYPMYvHOkzv7tgY38rD+NvmELAzeESBTbHN/wJyFkVbdD3mHVvE/vARGLxZB1lx+JN+gNjrrXT90FQtyWEchWoUcO6eFTAUdLgLonSn7SvI7lze2YUIS9BBc0OdpZzhDnWecUA1N0c5CeMZcjxroZYTuXH1YDGqOacphtZ7TMwCV2V5i7k9Jj4xY8uuSX92l7cW+EIqoqp26XTWmfon/jvDvWe3Dhe/mdtLXKQ2Lu8KCiN+zqA91fiGwezTkoeyDrWh/8/jqoz7Ep/4BN9cNLrbk75ngiryPlGLOCQK7vAgMBAAGjJzAlMBMGA1UdJQQMMAoGCCsGAQUFBwMBMA4GA1UdDwQHAwUAsAAAADANBgkqhkiG9w0BAQUFAAOCAQEAVTHuMl7Tr+ZAQOLf9nPbAlFabec8DFb+3jzbo4qUfGD/DYGuDg4gFNfr09s2Ft82DzXf1BQJDprRIRtrQOE8hDpOeM6c5sOXk7xKh0QjPzqE4n7ZJUP8X+NW+Zu9D7OaFSJ0/mUffw/PugoYTusfCEudrKzo2CDgtrQjaTrm7zkxksJdH/DY+YCF1g+ljpUDKR9SYwRaGQ5fj9dn+SMibhcXqDXod+BGKW9xaTo3CLFKSbMRt97LjF+P8sfnq8IGTpHqHR3pFDjdbIQ4ixRCygEpbVZJgXPvcTk2Nnvi3SyLZPeTRTGnZM0R7KMhLji2JnHYEXArC46fVwHtjLGbGw==&lt;/X509Certificate&gt;
                      &lt;/X509Data&gt;
                  &lt;/KeyInfo&gt;
              &lt;/Signature&gt;
              &lt;Subject&gt;
                  &lt;NameID&gt;e8f279d7-cbd8-468d-a6df-97419729fe59&lt;/NameID&gt;
                  &lt;SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer" /&gt;
              &lt;/Subject&gt;
              &lt;Conditions NotBefore="2013-04-17T19:37:18.399Z" NotOnOrAfter="2013-04-17T20:07:18.399Z"&gt;
                  &lt;AudienceRestriction&gt;
                      &lt;Audience&gt;https://[SP Server]&lt;/Audience&gt;
                  &lt;/AudienceRestriction&gt;
              &lt;/Conditions&gt;
              &lt;AttributeStatement&gt;
                  &lt;!-- Data from my database--&gt;
              &lt;/AttributeStatement&gt;
              &lt;AuthnStatement AuthnInstant="2013-04-17T19:37:18.337Z"&gt;
                  &lt;AuthnContext&gt;
                      &lt;AuthnContextClassRef&gt;urn:oasis:names:tc:SAML:2.0:ac:classes:Password&lt;/AuthnContextClassRef&gt;
                  &lt;/AuthnContext&gt;
              &lt;/AuthnStatement&gt;
          &lt;/Assertion&gt;
      &lt;/trust:RequestedSecurityToken&gt;
      &lt;trust:RequestedAttachedReference&gt;
          &lt;SecurityTokenReference d4p1:TokenType="http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0" xmlns:d4p1="http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd" xmlns="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"&gt;
              &lt;KeyIdentifier ValueType="http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID"&gt;_b4c87094-9557-419f-92fd-714a2b9cd8af&lt;/KeyIdentifier&gt;
          &lt;/SecurityTokenReference&gt;
      &lt;/trust:RequestedAttachedReference&gt;
      &lt;trust:RequestedUnattachedReference&gt;
          &lt;SecurityTokenReference d4p1:TokenType="http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0" xmlns:d4p1="http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd" xmlns="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"&gt;
              &lt;KeyIdentifier ValueType="http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID"&gt;_b4c87094-9557-419f-92fd-714a2b9cd8af&lt;/KeyIdentifier&gt;
          &lt;/SecurityTokenReference&gt;
      &lt;/trust:RequestedUnattachedReference&gt;
      &lt;trust:TokenType&gt;urn:oasis:names:tc:SAML:2.0:assertion&lt;/trust:TokenType&gt;
      &lt;trust:RequestType&gt;http://docs.oasis-open.org/ws-sx/ws-trust/200512/Issue&lt;/trust:RequestType&gt;
      &lt;trust:KeyType&gt;http://docs.oasis-open.org/ws-sx/ws-trust/200512/Bearer&lt;/trust:KeyType&gt;
  &lt;/trust:RequestSecurityTokenResponse&gt;
  </code></pre>
  
  <p></p>