Anyone using Spring-ws with SAML authentication?

Question

We are considering spring-ws as the platform for implementing web services that will be deployed on weblogic. We need to use WS-Security with SAML tokens issued by our identity management platform (TFIM).

The Spring-ws documentation for XwsSecurityInterceptor does not mention SAML, and it is not clear to me if would work in this context.

I guess alternatives could be to do our own interceptor which uses OpenSAML or somehow utilises the SAML support in weblogic.

Does anyone have experience with this? Would be nice to aim for a solution that is known to be workable.

Answer 1

Apache WSS4J does support SAML tokens, and Spring-WS comes with a Wss4jSecurityInterceptor, so I'd guess you could get it working out of the box.