[xmlsectool] 01/02: XSTJ-59 - regression in DSA functionality
Ian Young
ian at iay.org.uk
Wed May 25 06:07:50 EDT 2016
This is an automated email from the git hooks/post-receive script.
iay pushed a commit to branch master
in repository xmlsectool.
commit 91c5d2fc32b67bb722767d8117ae7e54707ac5b0
Author: Ian Young <ian at iay.org.uk>
AuthorDate: Wed May 25 10:59:38 2016 +0100
XSTJ-59 - regression in DSA functionality
---
.../net/shibboleth/tool/xmlsectool/XmlSecTool.java | 71 ++++++----
.../net/shibboleth/tool/xmlsectool/BaseTest.java | 38 ++++++
.../net/shibboleth/tool/xmlsectool/XSTJ51.java | 2 -
.../net/shibboleth/tool/xmlsectool/XSTJ59Test.java | 62 +++++++++
.../tool/xmlsectool/XSTJ59Test-dsa1024.crt | 19 +++
.../tool/xmlsectool/XSTJ59Test-dsa1024.key | 12 ++
.../shibboleth/tool/xmlsectool/XSTJ59Test-in.xml | 119 +++++++++++++++++
.../tool/xmlsectool/XSTJ59Test-out1024.xml | 148 +++++++++++++++++++++
8 files changed, 440 insertions(+), 31 deletions(-)
diff --git a/src/main/java/net/shibboleth/tool/xmlsectool/XmlSecTool.java b/src/main/java/net/shibboleth/tool/xmlsectool/XmlSecTool.java
index 019b94f..48bab19 100644
--- a/src/main/java/net/shibboleth/tool/xmlsectool/XmlSecTool.java
+++ b/src/main/java/net/shibboleth/tool/xmlsectool/XmlSecTool.java
@@ -369,37 +369,12 @@ public final class XmlSecTool {
}
/*
- * Determine the signature algorithm:
- *
- * * if the CLI signatureAlgorithm has been used, it takes precedence.
- * * for RSA credentials, use an algorithm dependent on the digest algorithm chosen
- * * fall back to a signature algorithm based on the signing credential type.
+ * Determine the signature algorithm to use.
*/
+ final String signatureAlgorithm = determineSignatureAlgorithm(cli, signingCredential);
+ log.debug("signature algorithm {} selected from credential+digest", signatureAlgorithm);
final SignatureSigningConfiguration securityConfig =
SecurityConfigurationSupport.getGlobalSignatureSigningConfiguration();
- String signatureAlgorithm = cli.getSignatureAlgorithm();
- if (signatureAlgorithm == null) {
- final String credentialAlgorithm = signingCredential.getPublicKey().getAlgorithm();
- log.debug("credential public key algorithm is {}", credentialAlgorithm);
- if ("RSA".equals(credentialAlgorithm)) {
- signatureAlgorithm = cli.getDigest().getRsaAlgorithm();
- } else if ("EC".equals(credentialAlgorithm)) {
- signatureAlgorithm = cli.getDigest().getEcdsaAlgorithm();
- } else {
- /*
- * Not RSA, not EC, so probably some kind of symmetric algorithm or original DSA.
- *
- * Previously handled this way:
- *
- * signatureAlgorithm = securityConfig.getSignatureAlgorithmURI(signingCredential);
- *
- * For now, just refuse to deal with it.
- */
- log.error("unimplemented signing credential type: {}", credentialAlgorithm);
- throw new Terminator(ReturnCode.RC_SIG);
- }
- log.debug("signature algorithm {} selected from credential+digest", signatureAlgorithm);
- }
final boolean hmac = AlgorithmSupport.isHMAC(signatureAlgorithm);
final Integer hmacOutputLength = securityConfig.getSignatureHMACOutputLength();
@@ -414,7 +389,7 @@ public final class XmlSecTool {
digestAlgorithm = cli.getDigest().getDigestAlgorithm();
}
- String c14nAlgorithm = SignatureConstants.ALGO_ID_C14N_EXCL_OMIT_COMMENTS;
+ final String c14nAlgorithm = SignatureConstants.ALGO_ID_C14N_EXCL_OMIT_COMMENTS;
try {
final XMLSignature signature;
@@ -443,6 +418,44 @@ public final class XmlSecTool {
throw new Terminator(ReturnCode.RC_SIG);
}
}
+
+ /**
+ * Determine the signature algorithm to use.
+ *
+ * <ul>
+ * <li>if the CLI signatureAlgorithm has been used, it takes precedence.
+ * <li>for RSA or ECDSA credentials, use an algorithm dependent on the digest algorithm chosen
+ * <li>for DSA, always use DSA + SHA-1
+ * </ul>
+ *
+ * @param cli command line arguments
+ * @param signingCredential credential to use for signing
+ * @return algorithm URI as a {@link String}
+ */
+ protected static String determineSignatureAlgorithm(@Nonnull final CommandLineArguments cli,
+ @Nonnull final X509Credential signingCredential) {
+
+ if (cli.getSignatureAlgorithm() != null) {
+ return cli.getSignatureAlgorithm();
+ }
+
+ final String credentialAlgorithm = signingCredential.getPublicKey().getAlgorithm();
+ log.debug("credential public key algorithm is {}", credentialAlgorithm);
+ switch (credentialAlgorithm) {
+ case "RSA":
+ return cli.getDigest().getRsaAlgorithm();
+
+ case "EC":
+ return cli.getDigest().getEcdsaAlgorithm();
+
+ case "DSA":
+ return SignatureConstants.ALGO_ID_SIGNATURE_DSA_SHA1;
+
+ default:
+ log.error("unimplemented signing credential type: {}", credentialAlgorithm);
+ throw new Terminator(ReturnCode.RC_SIG);
+ }
+ }
/**
* Populates an XML signature's KeyInfo with X.509 credential information.
diff --git a/src/test/java/net/shibboleth/tool/xmlsectool/BaseTest.java b/src/test/java/net/shibboleth/tool/xmlsectool/BaseTest.java
index d0d0662..443189f 100644
--- a/src/test/java/net/shibboleth/tool/xmlsectool/BaseTest.java
+++ b/src/test/java/net/shibboleth/tool/xmlsectool/BaseTest.java
@@ -9,15 +9,20 @@ import java.security.PublicKey;
import java.security.cert.CertificateException;
import java.util.MissingResourceException;
+import javax.annotation.Nonnull;
+
import org.custommonkey.xmlunit.Diff;
import org.custommonkey.xmlunit.XMLUnit;
import org.opensaml.core.config.InitializationException;
import org.opensaml.core.config.InitializationService;
import org.opensaml.security.x509.X509Credential;
+import org.opensaml.xmlsec.signature.support.SignatureConstants;
import org.testng.Assert;
import org.testng.annotations.BeforeClass;
import org.w3c.dom.Document;
+import org.w3c.dom.Element;
import org.w3c.dom.Node;
+import org.w3c.dom.NodeList;
import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
import net.shibboleth.utilities.java.support.logic.Constraint;
@@ -212,6 +217,39 @@ public abstract class BaseTest {
}
}
+ // *******************************
+ // *** ***
+ // *** S I G N A T U R E S ***
+ // *** ***
+ // *******************************
+
+ /**
+ * Set all SignatureValue elements to have the given value.
+ *
+ * This is useful for nondeterministic signature methods such as DSA.
+ *
+ * @param root root DOM {@link Element} below which values should be replaced
+ * @param value new value to place into all SignatureValue elements
+ */
+ protected void zapSignatureValues(@Nonnull final Element root, @Nonnull final String value) {
+ final NodeList nodes = root.getElementsByTagNameNS(SignatureConstants.XMLSIG_NS, "SignatureValue");
+ for (int index=0 ; index<nodes.getLength(); index++) {
+ final Node node = nodes.item(index);
+ node.setTextContent(value);
+ }
+ }
+
+ /**
+ * Set all SignatureValues elements to have the value "zap".
+ *
+ * This is useful for nondeterministic signature methods such as DSA.
+ *
+ * @param doc {@link Document} to operate on
+ */
+ protected void zapSignatureValues(@Nonnull final Document doc) {
+ zapSignatureValues(doc.getDocumentElement(), "zap");
+ }
+
// *********************************
// *** ***
// *** C R E D E N T I A L S ***
diff --git a/src/test/java/net/shibboleth/tool/xmlsectool/XSTJ51.java b/src/test/java/net/shibboleth/tool/xmlsectool/XSTJ51.java
index 1526c54..240c81d 100644
--- a/src/test/java/net/shibboleth/tool/xmlsectool/XSTJ51.java
+++ b/src/test/java/net/shibboleth/tool/xmlsectool/XSTJ51.java
@@ -39,8 +39,6 @@ public class XSTJ51 extends BaseTest {
cli.parseCommandLineArguments(args);
XmlSecTool.initLogging(cli);
- // check that the credential is of the right kind
-
// acquire a document to sign
final Document xml = readXMLDocument("in.xml");
diff --git a/src/test/java/net/shibboleth/tool/xmlsectool/XSTJ59Test.java b/src/test/java/net/shibboleth/tool/xmlsectool/XSTJ59Test.java
new file mode 100644
index 0000000..281232b
--- /dev/null
+++ b/src/test/java/net/shibboleth/tool/xmlsectool/XSTJ59Test.java
@@ -0,0 +1,62 @@
+package net.shibboleth.tool.xmlsectool;
+
+import java.security.interfaces.DSAPublicKey;
+
+import org.opensaml.security.x509.X509Credential;
+import org.testng.Assert;
+import org.testng.annotations.Test;
+import org.w3c.dom.Document;
+
+/**
+ * Test for regression against DSA signing ability.
+ */
+public class XSTJ59Test extends BaseTest {
+
+ XSTJ59Test() {
+ super(XSTJ59Test.class);
+ }
+
+ /**
+ * Test for regressions against earlier versions of xmlsectool using 1024-bit DSA and SHA-1 digest.
+ *
+ * @throws Exception if something goes wrong.
+ */
+ @Test
+ public void xstj59_1024_regression() throws Exception {
+ // acquire a credential to sign with
+ final X509Credential cred = getSigningCredential("dsa1024", "DSA", DSAPublicKey.class);
+
+ // build command-line arguments
+ final String[] args = {
+ "--sign",
+ "--inFile", "in.xml",
+ "--outFile", "out.xml",
+ "--certificate", "sign.crt",
+ "--key", "sign.key",
+ "--digest", "SHA-1",
+ "--whitelistDigest", "SHA-1"
+ };
+ final CommandLineArguments cli = new CommandLineArguments();
+ cli.parseCommandLineArguments(args);
+ XmlSecTool.initLogging(cli);
+
+ // check that the credential is of the right kind
+ final DSAPublicKey key = (DSAPublicKey)cred.getPublicKey();
+ Assert.assertEquals(key.getParams().getP().bitLength(), 1024);
+
+ // acquire a document to sign
+ final Document xml = readXMLDocument("in.xml");
+
+ // perform signature operation
+ XmlSecTool.sign(cli, cred, xml);
+
+ // verify the signature using our own code for consistency
+ XmlSecTool.verifySignature(cli, cred, xml);
+
+ // compare with output from V1.x
+ final Document out = readXMLDocument("out1024.xml");
+ zapSignatureValues(xml);
+ zapSignatureValues(out);
+ assertXMLIdentical(out.getDocumentElement(), xml.getDocumentElement());
+ }
+}
diff --git a/src/test/resources/net/shibboleth/tool/xmlsectool/XSTJ59Test-dsa1024.crt b/src/test/resources/net/shibboleth/tool/xmlsectool/XSTJ59Test-dsa1024.crt
new file mode 100644
index 0000000..fe2cf3f
--- /dev/null
+++ b/src/test/resources/net/shibboleth/tool/xmlsectool/XSTJ59Test-dsa1024.crt
@@ -0,0 +1,19 @@
+-----BEGIN CERTIFICATE-----
+MIIDGTCCAtegAwIBAgIJAJD0B7F64sGoMAsGCWCGSAFlAwQDAjBFMQswCQYDVQQG
+EwJBVTETMBEGA1UECAwKU29tZS1TdGF0ZTEhMB8GA1UECgwYSW50ZXJuZXQgV2lk
+Z2l0cyBQdHkgTHRkMB4XDTE2MDUyNTA4MzAwMVoXDTI2MDUyMzA4MzAwMVowRTEL
+MAkGA1UEBhMCQVUxEzARBgNVBAgMClNvbWUtU3RhdGUxITAfBgNVBAoMGEludGVy
+bmV0IFdpZGdpdHMgUHR5IEx0ZDCCAbYwggErBgcqhkjOOAQBMIIBHgKBgQDGKfB1
+UCzWaheKKRhOclwG1B7Kp+cCnIDwApyVDYY9LJgbvH3OAkYapGN1aUY+82WYZLpN
+jYCJ+9DilCJqmFURo4+i+qitktwUn04kZDCavHUZugvfmmYk/4SFf/CcQqM7IREB
+ccSaeaILij9h8P6TqHcEs0pVVBo3et8RY5004QIVAO5xwOX1N+jwGV0Z9qKlmCle
+3/8fAoGAONeEM1ut1xbqkulV6FZumwJyGiZefwn6Wp6nDDLNlAlunYyJNckIeHKO
+Wt/ezXenbmHcHWhNGglCyYa/afxH5QLHm9CEguz80W1kKJ/CeexVPslmLrxFndpO
+Pz0Ahqpj7GR7fSyGz++BWt3WjDb9kMLpmHWMtkMyCwejyF7uDFgDgYQAAoGAJdaZ
+A9Qt/L7sAMcAZT62hwldz/j3WrlrONQA5CEh8r2mUg/dtHMdXQ3V/WC4ZFtv0w89
+1H5JSyVk8bzHxxkZpulK0W3lSTmTHEBTcdv1aOF251wcg6MwYuQnbB6teWsdTmbZ
+3kivyd2tMYnbpvB/ctu8luzOAnnPg+BU1UrcldKjUDBOMB0GA1UdDgQWBBQxiUq4
+m+/AjQMgR0owYnR31iDyTTAfBgNVHSMEGDAWgBQxiUq4m+/AjQMgR0owYnR31iDy
+TTAMBgNVHRMEBTADAQH/MAsGCWCGSAFlAwQDAgMvADAsAhRJJuPrL6TiRE819Mde
+Efn7f48+oQIUGouVTCvDlMVG+D9Itruj4QC3yQ4=
+-----END CERTIFICATE-----
diff --git a/src/test/resources/net/shibboleth/tool/xmlsectool/XSTJ59Test-dsa1024.key b/src/test/resources/net/shibboleth/tool/xmlsectool/XSTJ59Test-dsa1024.key
new file mode 100644
index 0000000..a373261
--- /dev/null
+++ b/src/test/resources/net/shibboleth/tool/xmlsectool/XSTJ59Test-dsa1024.key
@@ -0,0 +1,12 @@
+-----BEGIN DSA PRIVATE KEY-----
+MIIBugIBAAKBgQDGKfB1UCzWaheKKRhOclwG1B7Kp+cCnIDwApyVDYY9LJgbvH3O
+AkYapGN1aUY+82WYZLpNjYCJ+9DilCJqmFURo4+i+qitktwUn04kZDCavHUZugvf
+mmYk/4SFf/CcQqM7IREBccSaeaILij9h8P6TqHcEs0pVVBo3et8RY5004QIVAO5x
+wOX1N+jwGV0Z9qKlmCle3/8fAoGAONeEM1ut1xbqkulV6FZumwJyGiZefwn6Wp6n
+DDLNlAlunYyJNckIeHKOWt/ezXenbmHcHWhNGglCyYa/afxH5QLHm9CEguz80W1k
+KJ/CeexVPslmLrxFndpOPz0Ahqpj7GR7fSyGz++BWt3WjDb9kMLpmHWMtkMyCwej
+yF7uDFgCgYAl1pkD1C38vuwAxwBlPraHCV3P+PdauWs41ADkISHyvaZSD920cx1d
+DdX9YLhkW2/TDz3UfklLJWTxvMfHGRmm6UrRbeVJOZMcQFNx2/Vo4XbnXByDozBi
+5CdsHq15ax1OZtneSK/J3a0xidum8H9y27yW7M4Cec+D4FTVStyV0gIUf5ecBv2m
+r30eKFGULlzebPurvWg=
+-----END DSA PRIVATE KEY-----
diff --git a/src/test/resources/net/shibboleth/tool/xmlsectool/XSTJ59Test-in.xml b/src/test/resources/net/shibboleth/tool/xmlsectool/XSTJ59Test-in.xml
new file mode 100644
index 0000000..cd3c3f0
--- /dev/null
+++ b/src/test/resources/net/shibboleth/tool/xmlsectool/XSTJ59Test-in.xml
@@ -0,0 +1,119 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata"
+ xmlns:ukfedlabel="http://ukfederation.org.uk/2006/11/label"
+ xmlns:shibmd="urn:mace:shibboleth:metadata:1.0" xmlns:ds="http://www.w3.org/2000/09/xmldsig#"
+ xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xsi:schemaLocation="urn:oasis:names:tc:SAML:2.0:metadata ../xml/saml-schema-metadata-2.0.xsd
+ urn:oasis:names:tc:SAML:metadata:algsupport ../xml/sstc-saml-metadata-algsupport-v1.0.xsd
+ urn:oasis:names:tc:SAML:metadata:ui ../xml/sstc-saml-metadata-ui-v1.0.xsd
+ urn:oasis:names:tc:SAML:profiles:SSO:idp-discovery-protocol ../xml/sstc-saml-idp-discovery.xsd
+ urn:oasis:names:tc:SAML:profiles:SSO:request-init ../xml/sstc-request-initiation.xsd
+ urn:mace:shibboleth:metadata:1.0 ../xml/shibboleth-metadata-1.0.xsd
+ http://ukfederation.org.uk/2006/11/label ../xml/uk-fed-label.xsd
+ http://www.w3.org/2001/04/xmlenc# ../xml/xenc-schema.xsd
+ http://www.w3.org/2000/09/xmldsig# ../xml/xmldsig-core-schema.xsd"
+ ID="uk001480" entityID="https://idp.shibboleth.net/idp/shibboleth">
+ <!--
+ This is a shibboleth.net Shibboleth 2 IdP for the JISC Services Management Company Ltd.
+ -->
+ <Extensions>
+ <shibmd:Scope regexp="false">shibboleth.net</shibmd:Scope>
+ <ukfedlabel:UKFederationMember/>
+ <ukfedlabel:ExportOptIn date="2011-12-07"/>
+ <ukfedlabel:Software fullVersion="2.3.8" version="2" name="Shibboleth" date="2012-12-07"/>
+ <alg:DigestMethod xmlns:alg="urn:oasis:names:tc:SAML:metadata:algsupport"
+ Algorithm="http://www.w3.org/2001/04/xmlenc#sha512"/>
+ <alg:DigestMethod xmlns:alg="urn:oasis:names:tc:SAML:metadata:algsupport"
+ Algorithm="http://www.w3.org/2001/04/xmldsig-more#sha384"/>
+ <alg:DigestMethod xmlns:alg="urn:oasis:names:tc:SAML:metadata:algsupport"
+ Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
+ <alg:DigestMethod xmlns:alg="urn:oasis:names:tc:SAML:metadata:algsupport"
+ Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
+ <alg:SigningMethod xmlns:alg="urn:oasis:names:tc:SAML:metadata:algsupport"
+ Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha512"/>
+ <alg:SigningMethod xmlns:alg="urn:oasis:names:tc:SAML:metadata:algsupport"
+ Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha384"/>
+ <alg:SigningMethod xmlns:alg="urn:oasis:names:tc:SAML:metadata:algsupport"
+ Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/>
+ <alg:SigningMethod xmlns:alg="urn:oasis:names:tc:SAML:metadata:algsupport"
+ Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
+ </Extensions>
+ <IDPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
+ <Extensions>
+ <shibmd:Scope regexp="false">shibboleth.net</shibmd:Scope>
+ <mdui:UIInfo xmlns:mdui="urn:oasis:names:tc:SAML:metadata:ui">
+ <mdui:DisplayName xml:lang="en">Shibboleth.net</mdui:DisplayName>
+ <mdui:Description xml:lang="en">An identity provider hosted and used by the
+ developers of Shibboleth.</mdui:Description>
+ <mdui:Logo height="82" width="64">https://shibboleth.net/images/gryphon_64x82.png</mdui:Logo>
+ </mdui:UIInfo>
+ </Extensions>
+ <KeyDescriptor>
+ <ds:KeyInfo>
+ <ds:X509Data>
+ <ds:X509Certificate>
+ MIIDNDCCAhygAwIBAgIVAKyBWnv1/h1U11C7kHvV33FIrEsJMA0GCSqGSIb3DQEB
+ BQUAMB0xGzAZBgNVBAMTEmlkcC5zaGliYm9sZXRoLm5ldDAeFw0xMDEyMjkwMDA5
+ MTlaFw0zMDEyMjkwMDA5MTlaMB0xGzAZBgNVBAMTEmlkcC5zaGliYm9sZXRoLm5l
+ dDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAKjWAdpUx/82FUzrRMfA
+ M63PkZZYCm3RnT3eiL+DeJcbGdcEJx/o+32vgHXJgJOBt14YdVam5GErIYgk4SGq
+ 5Z5RYl0PpQn6HQG/9prGnYCu6p5zfb0557o51Eh8TcVehS6Y2ruyCjAF0jgVMwh5
+ /0Oh8EE9wG93pSpm70DAiiaTVCb8WoT1aZYtxbBmmuH10bU+wge/NMmaHuVAe599
+ pyezFIL4FoI2g+1Q6nG4Yl1Z07I81tTApXKVMWRt/4/M3m2D7PUMOQ9qsxthp2L/
+ LovIeNo0bTyeW290T2Y/JRZhKOgeDqkhuu82DPri2Vm5G/unB69KfRB7CF9QWIc3
+ y80CAwEAAaNrMGkwSAYDVR0RBEEwP4ISaWRwLnNoaWJib2xldGgubmV0hilodHRw
+ czovL2lkcC5zaGliYm9sZXRoLm5ldC9pZHAvc2hpYmJvbGV0aDAdBgNVHQ4EFgQU
+ 3uZ32tKXJBzPCTp2dtHSLV0FvGgwDQYJKoZIhvcNAQEFBQADggEBAAYXYuzp0UTj
+ 3yLRvUCbEtaw9b80+weOELkVv3WFY3QAG8pIKEblrMMtzrzLFWZwYwwMZDab/HnH
+ egmgjZBthrOedEmoJ+OHRmIiS8zdZxVGEadJhTUaeIkO6kwK7Ht3nQePoiXV7TI5
+ +A9SpmZGoukC85Za4wGDw4xWGs5t5l6tBuuV+1s0oC6T8ih5n/NyThfpbihSW0d7
+ iBfSUickgpoM2BLM3FCnbO8HOsX1rGV4ypG9ZGDDvr2jrzalXXmc05gSlL2qd9ce
+ Q1M+9vavusPCqlj2zZf2/HfzhyiFcb/OgA0oTFWW2ynXji6UarIV5QaPoi/XmGmx
+ BXD36HfGBXk=
+ </ds:X509Certificate>
+ </ds:X509Data>
+ </ds:KeyInfo>
+ <EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#aes256-cbc"/>
+ <EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#aes192-cbc"/>
+ <EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#aes128-cbc"/>
+ <EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#tripledes-cbc"/>
+ <EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p"/>
+ </KeyDescriptor>
+ <NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</NameIDFormat>
+ <SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
+ Location="https://shibboleth.net/idp/profile/SAML2/POST/SSO"/>
+ <SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign"
+ Location="https://shibboleth.net/idp/profile/SAML2/POST-SimpleSign/SSO"/>
+ <SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"
+ Location="https://shibboleth.net/idp/profile/SAML2/Redirect/SSO"/>
+ </IDPSSODescriptor>
+ <Organization>
+ <OrganizationName xml:lang="en">JISC Services Management Company Ltd</OrganizationName>
+ <OrganizationDisplayName xml:lang="en">Shibboleth.net</OrganizationDisplayName>
+ <OrganizationURL xml:lang="en">http://www.shibboleth.net/</OrganizationURL>
+ </Organization>
+ <ContactPerson contactType="support">
+ <GivenName>Shibboleth.Net Technical Support</GivenName>
+ <EmailAddress>mailto:contact at shibboleth.net</EmailAddress>
+ </ContactPerson>
+ <ContactPerson contactType="technical">
+ <GivenName>Scott</GivenName>
+ <SurName>Cantor</SurName>
+ <EmailAddress>mailto:cantor.2 at osu.edu</EmailAddress>
+ </ContactPerson>
+ <ContactPerson contactType="technical">
+ <GivenName>Ian</GivenName>
+ <SurName>Young</SurName>
+ <EmailAddress>mailto:ukfed at iay.org.uk</EmailAddress>
+ </ContactPerson>
+ <ContactPerson contactType="administrative">
+ <GivenName>Scott</GivenName>
+ <SurName>Cantor</SurName>
+ <EmailAddress>mailto:cantor.2 at osu.edu</EmailAddress>
+ </ContactPerson>
+ <ContactPerson contactType="administrative">
+ <GivenName>Ian</GivenName>
+ <SurName>Young</SurName>
+ <EmailAddress>mailto:ian at iay.org.uk</EmailAddress>
+ </ContactPerson>
+</EntityDescriptor>
diff --git a/src/test/resources/net/shibboleth/tool/xmlsectool/XSTJ59Test-out1024.xml b/src/test/resources/net/shibboleth/tool/xmlsectool/XSTJ59Test-out1024.xml
new file mode 100644
index 0000000..65bdff6
--- /dev/null
+++ b/src/test/resources/net/shibboleth/tool/xmlsectool/XSTJ59Test-out1024.xml
@@ -0,0 +1,148 @@
+<?xml version="1.0" encoding="UTF-8"?><EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata" xmlns:ds="http://www.w3.org/2000/09/xmldsig#" xmlns:shibmd="urn:mace:shibboleth:metadata:1.0" xmlns:ukfedlabel="http://ukfederation.org.uk/2006/11/label" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" ID="uk001480" entityID="https://idp.shibboleth.net/idp/shibboleth" xsi:schemaLocation="urn:oasis:names:tc:SAML:2.0:metadata ../xml/saml-schema-metadata-2.0.xsd urn:oasis:names:tc: [...]
+<ds:SignedInfo>
+<ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
+<ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#dsa-sha1"/>
+<ds:Reference URI="">
+<ds:Transforms>
+<ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
+<ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
+</ds:Transforms>
+<ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
+<ds:DigestValue>jqavqiD2t/UhHDW03i8gT5iwLwI=</ds:DigestValue>
+</ds:Reference>
+</ds:SignedInfo>
+<ds:SignatureValue>cMdF9dWWZy8CrU84GBPVMEiprxRb1TZbGWmO3u1Oh+g62r/2+5ZXOQ==</ds:SignatureValue>
+<ds:KeyInfo>
+<ds:KeyValue>
+<ds:DSAKeyValue>
+<ds:P>
+xinwdVAs1moXiikYTnJcBtQeyqfnApyA8AKclQ2GPSyYG7x9zgJGGqRjdWlGPvNlmGS6TY2AifvQ
+4pQiaphVEaOPovqorZLcFJ9OJGQwmrx1GboL35pmJP+EhX/wnEKjOyERAXHEmnmiC4o/YfD+k6h3
+BLNKVVQaN3rfEWOdNOE=
+</ds:P>
+<ds:Q>7nHA5fU36PAZXRn2oqWYKV7f/x8=</ds:Q>
+<ds:G>
+ONeEM1ut1xbqkulV6FZumwJyGiZefwn6Wp6nDDLNlAlunYyJNckIeHKOWt/ezXenbmHcHWhNGglC
+yYa/afxH5QLHm9CEguz80W1kKJ/CeexVPslmLrxFndpOPz0Ahqpj7GR7fSyGz++BWt3WjDb9kMLp
+mHWMtkMyCwejyF7uDFg=
+</ds:G>
+<ds:Y>
+JdaZA9Qt/L7sAMcAZT62hwldz/j3WrlrONQA5CEh8r2mUg/dtHMdXQ3V/WC4ZFtv0w891H5JSyVk
+8bzHxxkZpulK0W3lSTmTHEBTcdv1aOF251wcg6MwYuQnbB6teWsdTmbZ3kivyd2tMYnbpvB/ctu8
+luzOAnnPg+BU1UrcldI=
+</ds:Y>
+</ds:DSAKeyValue>
+</ds:KeyValue>
+<ds:X509Data>
+<ds:X509Certificate>
+MIIDGTCCAtegAwIBAgIJAJD0B7F64sGoMAsGCWCGSAFlAwQDAjBFMQswCQYDVQQGEwJBVTETMBEG
+A1UECAwKU29tZS1TdGF0ZTEhMB8GA1UECgwYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMB4XDTE2
+MDUyNTA4MzAwMVoXDTI2MDUyMzA4MzAwMVowRTELMAkGA1UEBhMCQVUxEzARBgNVBAgMClNvbWUt
+U3RhdGUxITAfBgNVBAoMGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZDCCAbYwggErBgcqhkjOOAQB
+MIIBHgKBgQDGKfB1UCzWaheKKRhOclwG1B7Kp+cCnIDwApyVDYY9LJgbvH3OAkYapGN1aUY+82WY
+ZLpNjYCJ+9DilCJqmFURo4+i+qitktwUn04kZDCavHUZugvfmmYk/4SFf/CcQqM7IREBccSaeaIL
+ij9h8P6TqHcEs0pVVBo3et8RY5004QIVAO5xwOX1N+jwGV0Z9qKlmCle3/8fAoGAONeEM1ut1xbq
+kulV6FZumwJyGiZefwn6Wp6nDDLNlAlunYyJNckIeHKOWt/ezXenbmHcHWhNGglCyYa/afxH5QLH
+m9CEguz80W1kKJ/CeexVPslmLrxFndpOPz0Ahqpj7GR7fSyGz++BWt3WjDb9kMLpmHWMtkMyCwej
+yF7uDFgDgYQAAoGAJdaZA9Qt/L7sAMcAZT62hwldz/j3WrlrONQA5CEh8r2mUg/dtHMdXQ3V/WC4
+ZFtv0w891H5JSyVk8bzHxxkZpulK0W3lSTmTHEBTcdv1aOF251wcg6MwYuQnbB6teWsdTmbZ3kiv
+yd2tMYnbpvB/ctu8luzOAnnPg+BU1UrcldKjUDBOMB0GA1UdDgQWBBQxiUq4m+/AjQMgR0owYnR3
+1iDyTTAfBgNVHSMEGDAWgBQxiUq4m+/AjQMgR0owYnR31iDyTTAMBgNVHRMEBTADAQH/MAsGCWCG
+SAFlAwQDAgMvADAsAhRJJuPrL6TiRE819MdeEfn7f48+oQIUGouVTCvDlMVG+D9Itruj4QC3yQ4=
+</ds:X509Certificate>
+</ds:X509Data>
+</ds:KeyInfo>
+</ds:Signature>
+ <!--
+ This is a shibboleth.net Shibboleth 2 IdP for the JISC Services Management Company Ltd.
+ -->
+ <Extensions>
+ <shibmd:Scope regexp="false">shibboleth.net</shibmd:Scope>
+ <ukfedlabel:UKFederationMember/>
+ <ukfedlabel:ExportOptIn date="2011-12-07"/>
+ <ukfedlabel:Software date="2012-12-07" fullVersion="2.3.8" name="Shibboleth" version="2"/>
+ <alg:DigestMethod xmlns:alg="urn:oasis:names:tc:SAML:metadata:algsupport" Algorithm="http://www.w3.org/2001/04/xmlenc#sha512"/>
+ <alg:DigestMethod xmlns:alg="urn:oasis:names:tc:SAML:metadata:algsupport" Algorithm="http://www.w3.org/2001/04/xmldsig-more#sha384"/>
+ <alg:DigestMethod xmlns:alg="urn:oasis:names:tc:SAML:metadata:algsupport" Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
+ <alg:DigestMethod xmlns:alg="urn:oasis:names:tc:SAML:metadata:algsupport" Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
+ <alg:SigningMethod xmlns:alg="urn:oasis:names:tc:SAML:metadata:algsupport" Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha512"/>
+ <alg:SigningMethod xmlns:alg="urn:oasis:names:tc:SAML:metadata:algsupport" Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha384"/>
+ <alg:SigningMethod xmlns:alg="urn:oasis:names:tc:SAML:metadata:algsupport" Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/>
+ <alg:SigningMethod xmlns:alg="urn:oasis:names:tc:SAML:metadata:algsupport" Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
+ </Extensions>
+ <IDPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
+ <Extensions>
+ <shibmd:Scope regexp="false">shibboleth.net</shibmd:Scope>
+ <mdui:UIInfo xmlns:mdui="urn:oasis:names:tc:SAML:metadata:ui">
+ <mdui:DisplayName xml:lang="en">Shibboleth.net</mdui:DisplayName>
+ <mdui:Description xml:lang="en">An identity provider hosted and used by the
+ developers of Shibboleth.</mdui:Description>
+ <mdui:Logo height="82" width="64">https://shibboleth.net/images/gryphon_64x82.png</mdui:Logo>
+ </mdui:UIInfo>
+ </Extensions>
+ <KeyDescriptor>
+ <ds:KeyInfo>
+ <ds:X509Data>
+ <ds:X509Certificate>
+ MIIDNDCCAhygAwIBAgIVAKyBWnv1/h1U11C7kHvV33FIrEsJMA0GCSqGSIb3DQEB
+ BQUAMB0xGzAZBgNVBAMTEmlkcC5zaGliYm9sZXRoLm5ldDAeFw0xMDEyMjkwMDA5
+ MTlaFw0zMDEyMjkwMDA5MTlaMB0xGzAZBgNVBAMTEmlkcC5zaGliYm9sZXRoLm5l
+ dDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAKjWAdpUx/82FUzrRMfA
+ M63PkZZYCm3RnT3eiL+DeJcbGdcEJx/o+32vgHXJgJOBt14YdVam5GErIYgk4SGq
+ 5Z5RYl0PpQn6HQG/9prGnYCu6p5zfb0557o51Eh8TcVehS6Y2ruyCjAF0jgVMwh5
+ /0Oh8EE9wG93pSpm70DAiiaTVCb8WoT1aZYtxbBmmuH10bU+wge/NMmaHuVAe599
+ pyezFIL4FoI2g+1Q6nG4Yl1Z07I81tTApXKVMWRt/4/M3m2D7PUMOQ9qsxthp2L/
+ LovIeNo0bTyeW290T2Y/JRZhKOgeDqkhuu82DPri2Vm5G/unB69KfRB7CF9QWIc3
+ y80CAwEAAaNrMGkwSAYDVR0RBEEwP4ISaWRwLnNoaWJib2xldGgubmV0hilodHRw
+ czovL2lkcC5zaGliYm9sZXRoLm5ldC9pZHAvc2hpYmJvbGV0aDAdBgNVHQ4EFgQU
+ 3uZ32tKXJBzPCTp2dtHSLV0FvGgwDQYJKoZIhvcNAQEFBQADggEBAAYXYuzp0UTj
+ 3yLRvUCbEtaw9b80+weOELkVv3WFY3QAG8pIKEblrMMtzrzLFWZwYwwMZDab/HnH
+ egmgjZBthrOedEmoJ+OHRmIiS8zdZxVGEadJhTUaeIkO6kwK7Ht3nQePoiXV7TI5
+ +A9SpmZGoukC85Za4wGDw4xWGs5t5l6tBuuV+1s0oC6T8ih5n/NyThfpbihSW0d7
+ iBfSUickgpoM2BLM3FCnbO8HOsX1rGV4ypG9ZGDDvr2jrzalXXmc05gSlL2qd9ce
+ Q1M+9vavusPCqlj2zZf2/HfzhyiFcb/OgA0oTFWW2ynXji6UarIV5QaPoi/XmGmx
+ BXD36HfGBXk=
+ </ds:X509Certificate>
+ </ds:X509Data>
+ </ds:KeyInfo>
+ <EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#aes256-cbc"/>
+ <EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#aes192-cbc"/>
+ <EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#aes128-cbc"/>
+ <EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#tripledes-cbc"/>
+ <EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p"/>
+ </KeyDescriptor>
+ <NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</NameIDFormat>
+ <SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://shibboleth.net/idp/profile/SAML2/POST/SSO"/>
+ <SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign" Location="https://shibboleth.net/idp/profile/SAML2/POST-SimpleSign/SSO"/>
+ <SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://shibboleth.net/idp/profile/SAML2/Redirect/SSO"/>
+ </IDPSSODescriptor>
+ <Organization>
+ <OrganizationName xml:lang="en">JISC Services Management Company Ltd</OrganizationName>
+ <OrganizationDisplayName xml:lang="en">Shibboleth.net</OrganizationDisplayName>
+ <OrganizationURL xml:lang="en">http://www.shibboleth.net/</OrganizationURL>
+ </Organization>
+ <ContactPerson contactType="support">
+ <GivenName>Shibboleth.Net Technical Support</GivenName>
+ <EmailAddress>mailto:contact at shibboleth.net</EmailAddress>
+ </ContactPerson>
+ <ContactPerson contactType="technical">
+ <GivenName>Scott</GivenName>
+ <SurName>Cantor</SurName>
+ <EmailAddress>mailto:cantor.2 at osu.edu</EmailAddress>
+ </ContactPerson>
+ <ContactPerson contactType="technical">
+ <GivenName>Ian</GivenName>
+ <SurName>Young</SurName>
+ <EmailAddress>mailto:ukfed at iay.org.uk</EmailAddress>
+ </ContactPerson>
+ <ContactPerson contactType="administrative">
+ <GivenName>Scott</GivenName>
+ <SurName>Cantor</SurName>
+ <EmailAddress>mailto:cantor.2 at osu.edu</EmailAddress>
+ </ContactPerson>
+ <ContactPerson contactType="administrative">
+ <GivenName>Ian</GivenName>
+ <SurName>Young</SurName>
+ <EmailAddress>mailto:ian at iay.org.uk</EmailAddress>
+ </ContactPerson>
+</EntityDescriptor>
\ No newline at end of file
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list