[JIRA] Created: (MDA-58) XMLSignatureSigningStage fails to properly sign metadata aggregated using the MDA

[dantech@idp.protectnetwork.org (JIRA)]

XMLSignatureSigningStage fails to properly sign metadata aggregated using the MDA
---------------------------------------------------------------------------------

                 Key: MDA-58
                 URL: https://issues.shibboleth.net/jira/browse/MDA-58
             Project: Metadata Aggregator
          Issue Type: Bug
          Components: SAML Metadata
    Affects Versions: 0.6.1
         Environment: Any OS, JDK 1.6.0_29
            Reporter: dantech at idp.protectnetwork.org
            Assignee: Chad La Joie
            Priority: Blocker
         Attachments: my-federation-config.xml

The new version of the MDA seemed to work fine, then today I actually
tried to get our SP to consume the metadata it aggregated and signed,
but every time I enabled the Signature MetadataFilter to validate the
signature I would get an error telling me "CRIT Shibboleth.Application
: error initializing MetadataProvider: SignatureMetadataFilter unable
to verify signature at root of metadata instance."

I assumed maybe my private/public key pair I was using to sign and
validate the metadata was bad, so I used openssl to verify that the
private key I used with the MDA to sign the metadata matched the
public key I was using in the SP to validate the signature.  Long
story short, openssl confirmed they matched.

Then I used xmlsectool to validate the signature on the metadata
generated by MDA and it complained as well, but gave me a little more
detail.

xmlsectool.sh --verifySignature --certificate
./certs/my-signing-cert.pem --inFile
/tmp/mda/federation/my-federation-metadata.xml
INFO  XmlSecTool - Reading XML document from file
'/tmp/mda/federation/my-federation-metadata.xml'
INFO  XmlSecTool - XML document parsed and is well-formed.
ERROR XmlSecTool - Unknown error
java.lang.StringIndexOutOfBoundsException: String index out of range: -1
at java.lang.String.substring(String.java:1937) ~[na:1.6.0_29]
at java.lang.String.substring(String.java:1904) ~[na:1.6.0_29]
at edu.internet2.middleware.security.XmlSecTool.validateSignatureReferenceUri(XmlSecTool.java:623)
~[xmlsectool-1.1.5.jar:na]
at edu.internet2.middleware.security.XmlSecTool.validateSignatureReference(XmlSecTool.java:602)
~[xmlsectool-1.1.5.jar:na]
at edu.internet2.middleware.security.XmlSecTool.verifySignature(XmlSecTool.java:554)
~[xmlsectool-1.1.5.jar:na]
at edu.internet2.middleware.security.XmlSecTool.main(XmlSecTool.java:156)
~[xmlsectool-1.1.5.jar:na]

Which led me to
https://issues.shibboleth.net/jira/browse/XSTJ-15?page=com.atlassian.jira.plugin.system.issuetabpanels%3Acomment-tabpanel#issue-tabs

Then I decided to add an XMLSignatureValidationStage to my MDA
configuration to validate the signature after the MDA signed it, and I
got the following error:

mda.sh /tmp/mda/my-federation-config.xml validateSignature
2012-01-23 19:39:46,391 - WARN
[org.apache.xml.security.signature.Reference:-1] - Verification failed
for URI ""
2012-01-23 19:39:46,394 - WARN
[org.apache.xml.security.signature.Reference:-1] - Expected Digest:
I0I+qxu89yE2c6grAFkgO+IbgaEv9DIhCYiGe+JDA/Q=
2012-01-23 19:39:46,395 - WARN
[org.apache.xml.security.signature.Reference:-1] - Actual Digest:
usLmjOJIFNbagPGDEVXW0C0fhwLEtZ8jt0FWWx0/VIA=

As I test I manually added an ID (ID=MYM20120123T194212) to the
EntitiesDescriptor that the MDA created using the
EntitiesDescriptorAssemblerStage, then I used xmlsectool to sign the
metadata using --referenceIdAttributeName ID.  Now I had no issues
validating the signature.

./xmlsectool.sh --sign --referenceIdAttributeName ID --inFile
/tmp/mda/federation/my-federation-metadata-unsigned.xml --key
../certs/my-signing-key.pem --certificate ../certs/my-signing-cert.pem
--outFile /tmp/mda/federation/my-federation-metadata.xml
INFO  XmlSecTool - Reading XML document from file
'/tmp/mda/federation/my-federation-metadata-unsigned.xml'
INFO  XmlSecTool - XML document parsed and is well-formed.
INFO  XmlSecTool - XML document successfully signed
INFO  XmlSecTool - XML document written to file
/tmp/mda/federation/my-federation-metadata.xml

./xmlsectool.sh --verifySignature --signatureRequired --certificate
../certs/my-signing-cert.pem --inFile
/tmp/mda/federation/my-federation-metadata.xml
INFO  XmlSecTool - Reading XML document from file
'/tmp/mda/federation/my-federation-metadata.xml'
INFO  XmlSecTool - XML document parsed and is well-formed.
INFO  XmlSecTool - XML document signature verified.

I also tried using XMLSignatureSigningStage to sign metadata 
after I manually added the ID attribute to the EntitiesDescriptor 
element and it continued to leave the Reference URI = "", so 
it would seem that even if we were to create a new stage to 
add the ID, the XMLSignatureSigningStage would still fail 
to fill out the Reference URI properly.    

Here is my understanding of the issue...

The signature that the MDA is adding isn't valid because the Reference
URI for the Signature isn't getting set by my
XMLSignatureSigningStage, the reason the Reference URI isn't getting
set is because the EntitiesDescriptorAssemblerStage doesn't set the ID
for the EntitiesDescriptor, the reason the ID isn't getting set for
the EntitiesDescriptor is because I don't have a
EntityDescriptorItemIdPopulationStage, and the reason I don't have an
EntityDescriptorItemIdPopulationStage is because I used the examples
to build my MDA configuration (which also don't use an
EntityDescriptorItemIdPopulationStage), so I never realized until
after several hours of debugging today that it was even necessary.


--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira