[JIRA] Updated: (MDA-58) XMLSignatureSigningStage fails to properly sign metadata aggregated using the MDA
Chad La Joie (JIRA)
noreply at shibboleth.net
Mon Mar 19 14:14:16 GMT 2012
[ https://issues.shibboleth.net/jira/browse/MDA-58?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Chad La Joie updated MDA-58:
----------------------------
Fix Version/s: 0.7
> XMLSignatureSigningStage fails to properly sign metadata aggregated using the MDA
> ---------------------------------------------------------------------------------
>
> Key: MDA-58
> URL: https://issues.shibboleth.net/jira/browse/MDA-58
> Project: Metadata Aggregator
> Issue Type: Bug
> Components: SAML Metadata
> Affects Versions: 0.6.1
> Environment: Any OS, JDK 1.6.0_29
> Reporter: dantech at idp.protectnetwork.org
> Assignee: Chad La Joie
> Priority: Blocker
> Fix For: 0.7
>
> Attachments: my-federation-config.xml
>
>
> The new version of the MDA seemed to work fine, then today I actually
> tried to get our SP to consume the metadata it aggregated and signed,
> but every time I enabled the Signature MetadataFilter to validate the
> signature I would get an error telling me "CRIT Shibboleth.Application
> : error initializing MetadataProvider: SignatureMetadataFilter unable
> to verify signature at root of metadata instance."
> I assumed maybe my private/public key pair I was using to sign and
> validate the metadata was bad, so I used openssl to verify that the
> private key I used with the MDA to sign the metadata matched the
> public key I was using in the SP to validate the signature. Long
> story short, openssl confirmed they matched.
> Then I used xmlsectool to validate the signature on the metadata
> generated by MDA and it complained as well, but gave me a little more
> detail.
> xmlsectool.sh --verifySignature --certificate
> ./certs/my-signing-cert.pem --inFile
> /tmp/mda/federation/my-federation-metadata.xml
> INFO XmlSecTool - Reading XML document from file
> '/tmp/mda/federation/my-federation-metadata.xml'
> INFO XmlSecTool - XML document parsed and is well-formed.
> ERROR XmlSecTool - Unknown error
> java.lang.StringIndexOutOfBoundsException: String index out of range: -1
> at java.lang.String.substring(String.java:1937) ~[na:1.6.0_29]
> at java.lang.String.substring(String.java:1904) ~[na:1.6.0_29]
> at edu.internet2.middleware.security.XmlSecTool.validateSignatureReferenceUri(XmlSecTool.java:623)
> ~[xmlsectool-1.1.5.jar:na]
> at edu.internet2.middleware.security.XmlSecTool.validateSignatureReference(XmlSecTool.java:602)
> ~[xmlsectool-1.1.5.jar:na]
> at edu.internet2.middleware.security.XmlSecTool.verifySignature(XmlSecTool.java:554)
> ~[xmlsectool-1.1.5.jar:na]
> at edu.internet2.middleware.security.XmlSecTool.main(XmlSecTool.java:156)
> ~[xmlsectool-1.1.5.jar:na]
> Which led me to
> https://issues.shibboleth.net/jira/browse/XSTJ-15?page=com.atlassian.jira.plugin.system.issuetabpanels%3Acomment-tabpanel#issue-tabs
> Then I decided to add an XMLSignatureValidationStage to my MDA
> configuration to validate the signature after the MDA signed it, and I
> got the following error:
> mda.sh /tmp/mda/my-federation-config.xml validateSignature
> 2012-01-23 19:39:46,391 - WARN
> [org.apache.xml.security.signature.Reference:-1] - Verification failed
> for URI ""
> 2012-01-23 19:39:46,394 - WARN
> [org.apache.xml.security.signature.Reference:-1] - Expected Digest:
> I0I+qxu89yE2c6grAFkgO+IbgaEv9DIhCYiGe+JDA/Q=
> 2012-01-23 19:39:46,395 - WARN
> [org.apache.xml.security.signature.Reference:-1] - Actual Digest:
> usLmjOJIFNbagPGDEVXW0C0fhwLEtZ8jt0FWWx0/VIA=
> As I test I manually added an ID (ID=MYM20120123T194212) to the
> EntitiesDescriptor that the MDA created using the
> EntitiesDescriptorAssemblerStage, then I used xmlsectool to sign the
> metadata using --referenceIdAttributeName ID. Now I had no issues
> validating the signature.
> ./xmlsectool.sh --sign --referenceIdAttributeName ID --inFile
> /tmp/mda/federation/my-federation-metadata-unsigned.xml --key
> ../certs/my-signing-key.pem --certificate ../certs/my-signing-cert.pem
> --outFile /tmp/mda/federation/my-federation-metadata.xml
> INFO XmlSecTool - Reading XML document from file
> '/tmp/mda/federation/my-federation-metadata-unsigned.xml'
> INFO XmlSecTool - XML document parsed and is well-formed.
> INFO XmlSecTool - XML document successfully signed
> INFO XmlSecTool - XML document written to file
> /tmp/mda/federation/my-federation-metadata.xml
> ./xmlsectool.sh --verifySignature --signatureRequired --certificate
> ../certs/my-signing-cert.pem --inFile
> /tmp/mda/federation/my-federation-metadata.xml
> INFO XmlSecTool - Reading XML document from file
> '/tmp/mda/federation/my-federation-metadata.xml'
> INFO XmlSecTool - XML document parsed and is well-formed.
> INFO XmlSecTool - XML document signature verified.
> I also tried using XMLSignatureSigningStage to sign metadata
> after I manually added the ID attribute to the EntitiesDescriptor
> element and it continued to leave the Reference URI = "", so
> it would seem that even if we were to create a new stage to
> add the ID, the XMLSignatureSigningStage would still fail
> to fill out the Reference URI properly.
> Here is my understanding of the issue...
> The signature that the MDA is adding isn't valid because the Reference
> URI for the Signature isn't getting set by my
> XMLSignatureSigningStage, the reason the Reference URI isn't getting
> set is because the EntitiesDescriptorAssemblerStage doesn't set the ID
> for the EntitiesDescriptor, the reason the ID isn't getting set for
> the EntitiesDescriptor is because I don't have a
> EntityDescriptorItemIdPopulationStage, and the reason I don't have an
> EntityDescriptorItemIdPopulationStage is because I used the examples
> to build my MDA configuration (which also don't use an
> EntityDescriptorItemIdPopulationStage), so I never realized until
> after several hours of debugging today that it was even necessary.
--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira
More information about the commits
mailing list