[JIRA] Commented: (SSPCPP-513) Failure to validate Response Signature

[Scott Cantor (JIRA)]

    [ https://issues.shibboleth.net/jira/browse/SSPCPP-513?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14461#comment-14461 ] 

Scott Cantor commented on SSPCPP-513:
-------------------------------------

The signature issue is caused by an incorrect namespace on the X509Data and X509Certificate elements in the metadata. Adding ds: to the elements fixes the issue.

I didn't expect that the code would return a Credential object from the metadata with no key inside it. I'll look at that more closely, I might be able to prevent it from returning a credential with nothing inside it at all, which would limit at least some of these cases from being so obscure.

Bug reporter also noted inability to ignore the OneTimeUse condition, checking on that also.

> Failure to validate Response Signature
> --------------------------------------
>
>                 Key: SSPCPP-513
>                 URL: https://issues.shibboleth.net/jira/browse/SSPCPP-513
>             Project: Shibboleth SP - C++
>          Issue Type: Bug
>          Components: SAML 2.0 Single Sign-On
>    Affects Versions: 2.5.0
>            Reporter: rhoerbe at idp.protectnetwork.org
>            Assignee: Scott Cantor
>            Priority: Minor
>              Labels: TrustEngine
>         Attachments: shibspKeyExtr.zip
>
>
> as described in the mail thread on shib-users from today:
> These are the log messages after the Response was decoded:
> OpenSAML.MessageDecoder.SAML2 [2]: extracting issuer from SAML 2.0 protocol message
> OpenSAML.MessageDecoder.SAML2 [2]: message from (https://apps.egiz.gv.at/moa-id-stork-test/)
> OpenSAML.MessageDecoder.SAML2 [2]: searching metadata for message issuer...
> OpenSAML.SecurityPolicyRule.MessageFlow [2]: evaluating message flow policy (replay checking on, expiration 60)
> XMLTooling.StorageService [2]: inserted record (_eb6...) in context (MessageFlow) with expiration ..
> OpenSAML.SecurityPolicyRule.XMLSigning [2]: validating signature profile
> XMLTooling.KeyInfoResolver.Inline [2]: resolved 0 certificate(s)
> XMLTooling.KeyInfoResolver.Inline [2]: resolved 0 CRL(s)
> XMLTooling.TrustEngine.ExplicitKey [2]: attempting to validate signature with the peer's credentials
> XMLTooling.TrustEngine.ExplicitKey [2]: public key did not validate signature: Credential did not contain a verification key.
> The zip-archive contains the IDP's certificate files, metadata, response message and logfiles.

--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira