Update opensaml libraries to 4.x

https: //docs.spring.io/spring-security/reference/5.8/migration/servlet/saml2.html
Co-authored-by: Duane May <[email protected]>

dependencies.gradle

@@ -18,6 +18,7 @@ versions.seleniumVersion = "4.18.1"
 versions.braveVersion = "6.0.3"
 versions.jacksonVersion = "2.17.1"
 versions.jsonPathVersion = "2.9.0"
+versions.opensaml = "4.0.1"
 
 // Versions we're overriding from the Spring Boot Bom (Dependabot does not issue PRs to bump these versions, so we need to manually bump them)
 ext["mariadb.version"] = "2.7.12" // Bumping to v3 breaks some pipeline jobs (and compatibility with Amazon Aurora MySQL), so pinning to v2 for now. v2 (current version) is stable and will be supported until about September 2025 (https://mariadb.com/kb/en/about-mariadb-connector-j/).
@@ -131,6 +132,9 @@ libraries.orgJson = "org.json:json:20240303"
 libraries.owaspEsapi = "org.owasp.esapi:esapi:2.5.3.1"
 libraries.jodaTime = "joda-time:joda-time:2.12.7"
 libraries.apacheHttpClient = "org.apache.httpcomponents:httpclient:4.5.14"
+libraries.opensamlCore = "org.opensaml:opensaml-core:${versions.opensaml}"
+libraries.opensamlApi = "org.opensaml:opensaml-saml-api:${versions.opensaml}"
+libraries.opensamlImpl = "org.opensaml:opensaml-saml-impl:${versions.opensaml}"
 
 // gradle plugins
 libraries.testRetryPlugin = "org.gradle:test-retry-gradle-plugin:1.5.9"

uaa/build.gradle

@@ -18,6 +18,7 @@ war { enabled = true }
 
 repositories {
     maven { url("https://repo.spring.io/libs-milestone") }
+    maven { url "https://build.shibboleth.net/nexus/content/repositories/releases/" }
 }
 
 description = "UAA"
@@ -26,6 +27,9 @@ dependencies {
         exclude(module: "jna")
     }
     implementation(project(":cloudfoundry-identity-statsd-lib"))
+    implementation(libraries.opensamlCore)
+    implementation(libraries.opensamlApi)
+    implementation(libraries.opensamlImpl)
     implementation(project(":cloudfoundry-identity-model"))
     implementation(libraries.springSecurityConfig)
     implementation(libraries.springSecurityWeb)