[JIRA] Closed: (MDA-58) XMLSignatureSigningStage fails to properly sign metadata aggregated using the MDA
Chad La Joie (JIRA)
noreply at shibboleth.net
Wed Mar 28 16:14:16 BST 2012
[ https://issues.shibboleth.net/jira/browse/MDA-58?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Chad La Joie closed MDA-58.
---------------------------
Resolution: Fixed
A new stage, GenerateIdStage, is now available and generates the ID necessary for signing SAML bits. Deployers wanting to sign non-SAML things will need a similar stage in order to generate the ID appropriate for their content model.
XMLSignatureSigningStage now defaults to an idAttributeNames list that covers 'ID', 'Id", 'id'. Again, those wishing to use other ID attributes (e.g., wsu:Id) would need to specify those.
> XMLSignatureSigningStage fails to properly sign metadata aggregated using the MDA
> ---------------------------------------------------------------------------------
>
> Key: MDA-58
> URL: https://issues.shibboleth.net/jira/browse/MDA-58
> Project: Metadata Aggregator
> Issue Type: Bug
> Components: SAML Metadata
> Affects Versions: 0.6.1
> Environment: Any OS, JDK 1.6.0_29
> Reporter: dantech at idp.protectnetwork.org
> Assignee: Chad La Joie
> Priority: Blocker
> Fix For: 0.7
>
> Attachments: my-federation-config.xml
>
>
> The new version of the MDA seemed to work fine, then today I actually
> tried to get our SP to consume the metadata it aggregated and signed,
> but every time I enabled the Signature MetadataFilter to validate the
> signature I would get an error telling me "CRIT Shibboleth.Application
> : error initializing MetadataProvider: SignatureMetadataFilter unable
> to verify signature at root of metadata instance."
> I assumed maybe my private/public key pair I was using to sign and
> validate the metadata was bad, so I used openssl to verify that the
> private key I used with the MDA to sign the metadata matched the
> public key I was using in the SP to validate the signature. Long
> story short, openssl confirmed they matched.
> Then I used xmlsectool to validate the signature on the metadata
> generated by MDA and it complained as well, but gave me a little more
> detail.
> xmlsectool.sh --verifySignature --certificate
> ./certs/my-signing-cert.pem --inFile
> /tmp/mda/federation/my-federation-metadata.xml
> INFO XmlSecTool - Reading XML document from file
> '/tmp/mda/federation/my-federation-metadata.xml'
> INFO XmlSecTool - XML document parsed and is well-formed.
> ERROR XmlSecTool - Unknown error
> java.lang.StringIndexOutOfBoundsException: String index out of range: -1
> at java.lang.String.substring(String.java:1937) ~[na:1.6.0_29]
> at java.lang.String.substring(String.java:1904) ~[na:1.6.0_29]
> at edu.internet2.middleware.security.XmlSecTool.validateSignatureReferenceUri(XmlSecTool.java:623)
> ~[xmlsectool-1.1.5.jar:na]
> at edu.internet2.middleware.security.XmlSecTool.validateSignatureReference(XmlSecTool.java:602)
> ~[xmlsectool-1.1.5.jar:na]
> at edu.internet2.middleware.security.XmlSecTool.verifySignature(XmlSecTool.java:554)
> ~[xmlsectool-1.1.5.jar:na]
> at edu.internet2.middleware.security.XmlSecTool.main(XmlSecTool.java:156)
> ~[xmlsectool-1.1.5.jar:na]
> Which led me to
> https://issues.shibboleth.net/jira/browse/XSTJ-15?page=com.atlassian.jira.plugin.system.issuetabpanels%3Acomment-tabpanel#issue-tabs
> Then I decided to add an XMLSignatureValidationStage to my MDA
> configuration to validate the signature after the MDA signed it, and I
> got the following error:
> mda.sh /tmp/mda/my-federation-config.xml validateSignature
> 2012-01-23 19:39:46,391 - WARN
> [org.apache.xml.security.signature.Reference:-1] - Verification failed
> for URI ""
> 2012-01-23 19:39:46,394 - WARN
> [org.apache.xml.security.signature.Reference:-1] - Expected Digest:
> I0I+qxu89yE2c6grAFkgO+IbgaEv9DIhCYiGe+JDA/Q=
> 2012-01-23 19:39:46,395 - WARN
> [org.apache.xml.security.signature.Reference:-1] - Actual Digest:
> usLmjOJIFNbagPGDEVXW0C0fhwLEtZ8jt0FWWx0/VIA=
> As I test I manually added an ID (ID=MYM20120123T194212) to the
> EntitiesDescriptor that the MDA created using the
> EntitiesDescriptorAssemblerStage, then I used xmlsectool to sign the
> metadata using --referenceIdAttributeName ID. Now I had no issues
> validating the signature.
> ./xmlsectool.sh --sign --referenceIdAttributeName ID --inFile
> /tmp/mda/federation/my-federation-metadata-unsigned.xml --key
> ../certs/my-signing-key.pem --certificate ../certs/my-signing-cert.pem
> --outFile /tmp/mda/federation/my-federation-metadata.xml
> INFO XmlSecTool - Reading XML document from file
> '/tmp/mda/federation/my-federation-metadata-unsigned.xml'
> INFO XmlSecTool - XML document parsed and is well-formed.
> INFO XmlSecTool - XML document successfully signed
> INFO XmlSecTool - XML document written to file
> /tmp/mda/federation/my-federation-metadata.xml
> ./xmlsectool.sh --verifySignature --signatureRequired --certificate
> ../certs/my-signing-cert.pem --inFile
> /tmp/mda/federation/my-federation-metadata.xml
> INFO XmlSecTool - Reading XML document from file
> '/tmp/mda/federation/my-federation-metadata.xml'
> INFO XmlSecTool - XML document parsed and is well-formed.
> INFO XmlSecTool - XML document signature verified.
> I also tried using XMLSignatureSigningStage to sign metadata
> after I manually added the ID attribute to the EntitiesDescriptor
> element and it continued to leave the Reference URI = "", so
> it would seem that even if we were to create a new stage to
> add the ID, the XMLSignatureSigningStage would still fail
> to fill out the Reference URI properly.
> Here is my understanding of the issue...
> The signature that the MDA is adding isn't valid because the Reference
> URI for the Signature isn't getting set by my
> XMLSignatureSigningStage, the reason the Reference URI isn't getting
> set is because the EntitiesDescriptorAssemblerStage doesn't set the ID
> for the EntitiesDescriptor, the reason the ID isn't getting set for
> the EntitiesDescriptor is because I don't have a
> EntityDescriptorItemIdPopulationStage, and the reason I don't have an
> EntityDescriptorItemIdPopulationStage is because I used the examples
> to build my MDA configuration (which also don't use an
> EntityDescriptorItemIdPopulationStage), so I never realized until
> after several hours of debugging today that it was even necessary.
--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira
More information about the commits
mailing list