Check for opensaml version on OpenSaml support classes

[igorpele]

In OpenSaml support classes the Saml2VersionUtils class is used to check whether a supported version of OpenSaml is found on the classpath.

Closes gh-10567

[marcusdacoregio]

Hi @igorpele, just a heads up that we are discussing this solution and I should get back to you soon.

[marcusdacoregio]

Waiting for #10817 to get merged, since the way to verify the OpenSAML version may change

[marcusdacoregio]

We have changed the way we check the version, can you change it to:

Suggested change

	private static String getVersion() {
	String version = Version.getVersion();
	if (version != null) {
	return version;
	}
	return Version.class.getModule().getDescriptor().version().map(Object::toString)
	.orElseThrow(() -> new IllegalStateException("cannot determine OpenSAML version"));
	}
	private static String getVersion() {
	String version = Version.getVersion();
	if (StringUtils.hasText(version)) {
	return version;
	}
	boolean openSaml4ClassPresent = ClassUtils
	.isPresent("org.opensaml.core.xml.persist.impl.PassthroughSourceStrategy", null);
	if (openSaml4ClassPresent) {
	return OPEN_SAML_4_VERSION;
	}
	throw new IllegalStateException("cannot determine OpenSAML version");
	}

There is more detail here

[marcusdacoregio]

Could you change it to @since 5.8?

[igorpele]

Hi @marcusdacoregio is this ok now?
But I am not sure, as now if Version.getVersion() returns no value, Saml2VersionUtils.getVersion now returns the OPEN_SAML4_VERSION (4) which always be below 4.1.0 which is supported by spring-security? The "old" approach returned the accurate version of OpenSaml from classpath something like "4.0.1".

Or can I assume that if the class "org.opensaml.core.xml.persist.impl.PassthroughSourceStrategy" is present on the classpath that the OpenSaml version is higher than 4.1.0?

[marcusdacoregio]

Hey @igorpele, thanks for your contribution.

Unfortunately, this has not made it into our 5.8 release and we do not have another release planned for the 5.x line.
In Spring Security 6, we are only using OpenSAML4, therefore there is no need for a version check.

We might still do something like this if we add OpenSAML5 #11658.