Metadata Aggregator - Issues with XMLSignatureSigningStage
Krug, Jeff
Jeff.Krug at gtri.gatech.edu
Wed Nov 2 15:04:29 GMT 2011
This is definitely a fantastic tool. Thanks for the updates. I was able to get the 0.6.1 release running with very few hiccups in my testbed. The provided examples are great. I like the capabilities so much, I'm planning to migrate my federation metadata management over to it as soon as possible.
I did have one question regarding signing algorithm. Using the xmlsectool-1.1.4 I tweaked it to default to SHA256 signatures (and it uses Apache's digital signature classes to do this). This worked fine. The aggregator defaults to SHA256 (although conveniently configurable via a property) using the javax.crypto libraries, but for this I get the following error:
2011-11-02 10:52:30,398 - ERROR [net.shibboleth.metadata.dom.XMLSignatureSigningStage:644] - Unable to create signature method http://www.w3.org/2001/04/xmldsig-more#rsa-sha256
java.security.NoSuchAlgorithmException: unsupported algorithm
at org.jcp.xml.dsig.internal.dom.DOMXMLSignatureFactory.newSignatureMethod(Unknown Source) ~[na:1.6.0_16]
at net.shibboleth.metadata.dom.XMLSignatureSigningStage.buildSignedInfo(XMLSignatureSigningStage.java:641) [aggregator-pipeline-0.6.1.jar:na]
I can set it to use SHA1 via the property and it works fine, but I feel like there is something obvious I'm overlooking that needs to be done to support SHA256 (and better, the same type of error shows up for SHA384 and SHA512).
Thanks,
Jeff
________________________________________
From: dev-bounces at shibboleth.net [dev-bounces at shibboleth.net] on behalf of Chad La Joie [lajoie at itumi.biz]
Sent: Sunday, October 30, 2011 2:45 PM
To: Shib Dev
Subject: Re: Metadata Aggregator - Issues with XMLSignatureSigningStage
Okay Dan,
I just released 0.6.1 and made sure all the documentation was update.
I also include a new "non-trivial" example that demonstrates a lot of
the stages. So, give that a whirl.
On Sat, Oct 22, 2011 at 14:24, Dan McLaughlin
<dmclaughlin at tech-consortium.com> wrote:
> Has anyone had success using XMLSignatureSigningStage yet?
>
> $ mda.sh file:///Users/Dan/workspace/metadata_aggregator/config1.xml
> file:///Users/Dan/workspace/metadata_aggregator/my-test-federation.xml2011-10-22
> 13:15:05,467 - ERROR
> [net.shibboleth.metadata.cli.SimpleCommandLine:70] - Unable to
> initialize Spring
> contextorg.springframework.beans.factory.BeanCreationException: Error
> creating bean with name 'signMetadata' defined in URL
> [file:/Users/Dan/workspace/metadata_aggregator/config1.xml]:
> Initialization of bean failed; nested exception is
> org.springframework.beans.ConversionNotSupportedException: Failed to
> convert property value of type 'java.lang.String' to required type
> 'java.security.PrivateKey' for property 'privateKey'; nested exception
> is java.lang.IllegalStateException: Cannot convert value of type
> [java.lang.String] to required type [java.security.PrivateKey] for
> property 'privateKey': no matching editors or conversion strategy
> found at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:527)
> ~[spring-beans-3.0.5.RELEASE.jar:3.0.5.RELEASE] at
> org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:456)
> ~[spring-beans-3.0.5.RELEASE.jar:3.0.5.RELEASE] at
> org.springframework.beans.factory.support.AbstractBeanFactory$1.getObject(AbstractBeanFactory.java:291)
> ~[spring-beans-3.0.5.RELEASE.jar:3.0.5.RELEASE] at
> org.springframework.beans.factory.support.DefaultSingletonBeanRegistry.getSingleton(DefaultSingletonBeanRegistry.java:222)
> ~[spring-beans-3.0.5.RELEASE.jar:3.0.5.RELEASE] at
> org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:288)
> ~[spring-beans-3.0.5.RELEASE.jar:3.0.5.RELEASE] at
> org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:190)
> ~[spring-beans-3.0.5.RELEASE.jar:3.0.5.RELEASE] at
> org.springframework.beans.factory.support.DefaultListableBeanFactory.preInstantiateSingletons(DefaultListableBeanFactory.java:580)
> ~[spring-beans-3.0.5.RELEASE.jar:3.0.5.RELEASE] at
> org.springframework.context.support.AbstractApplicationContext.finishBeanFactoryInitialization(AbstractApplicationContext.java:895)
> ~[spring-context-3.0.5.RELEASE.jar:3.0.5.RELEASE] at
> org.springframework.context.support.AbstractApplicationContext.refresh(AbstractApplicationContext.java:425)
> ~[spring-context-3.0.5.RELEASE.jar:3.0.5.RELEASE] at
> org.springframework.context.support.FileSystemXmlApplicationContext.<init>(FileSystemXmlApplicationContext.java:140)
> ~[spring-context-3.0.5.RELEASE.jar:3.0.5.RELEASE] at
> org.springframework.context.support.FileSystemXmlApplicationContext.<init>(FileSystemXmlApplicationContext.java:84)
> ~[spring-context-3.0.5.RELEASE.jar:3.0.5.RELEASE] at
> net.shibboleth.metadata.cli.SimpleCommandLine.main(SimpleCommandLine.java:68)
> ~[aggregator-cli-0.5-SNAPSHOT.jar:na]Caused by:
> org.springframework.beans.ConversionNotSupportedException: Failed to
> convert property value of type 'java.lang.String' to required type
> 'java.security.PrivateKey' for property 'privateKey'; nested exception
> is java.lang.IllegalStateException: Cannot convert value of type
> [java.lang.String] to required type [java.security.PrivateKey] for
> property 'privateKey': no matching editors or conversion strategy
> found at org.springframework.beans.BeanWrapperImpl.convertIfNecessary(BeanWrapperImpl.java:462)
> ~[spring-beans-3.0.5.RELEASE.jar:3.0.5.RELEASE] at
> org.springframework.beans.BeanWrapperImpl.convertForProperty(BeanWrapperImpl.java:499)
> ~[spring-beans-3.0.5.RELEASE.jar:3.0.5.RELEASE] at
> org.springframework.beans.BeanWrapperImpl.convertForProperty(BeanWrapperImpl.java:493)
> ~[spring-beans-3.0.5.RELEASE.jar:3.0.5.RELEASE] at
> org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.convertForProperty(AbstractAutowireCapableBeanFactory.java:1371)
> ~[spring-beans-3.0.5.RELEASE.jar:3.0.5.RELEASE] at
> org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.applyPropertyValues(AbstractAutowireCapableBeanFactory.java:1330)
> ~[spring-beans-3.0.5.RELEASE.jar:3.0.5.RELEASE] at
> org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.populateBean(AbstractAutowireCapableBeanFactory.java:1086)
> ~[spring-beans-3.0.5.RELEASE.jar:3.0.5.RELEASE] at
> org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:517)
> ~[spring-beans-3.0.5.RELEASE.jar:3.0.5.RELEASE] ... 11 common frames
> omittedCaused by: java.lang.IllegalStateException: Cannot convert
> value of type [java.lang.String] to required type
> [java.security.PrivateKey] for property 'privateKey': no matching
> editors or conversion strategy found at
> org.springframework.beans.TypeConverterDelegate.convertIfNecessary(TypeConverterDelegate.java:231)
> ~[spring-beans-3.0.5.RELEASE.jar:3.0.5.RELEASE] at
> org.springframework.beans.BeanWrapperImpl.convertIfNecessary(BeanWrapperImpl.java:447)
> ~[spring-beans-3.0.5.RELEASE.jar:3.0.5.RELEASE] ... 17 common frames
> omitted
>
> <?xml version="1.0" encoding="UTF-8"?>
> <beans xmlns="http://www.springframework.org/schema/beans"
> xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
> xsi:schemaLocation="http://www.springframework.org/schema/beans
> http://www.springframework.org/schema/beans/spring-beans-3.0.xsd">
>
> <!-- First, we define the stages for our pipeline -->
> <bean id="source"
> class="net.shibboleth.metadata.dom.stage.DomFilesystemSourceStage">
> <property name="id" value="source"/>
> <property name="parserPool">
> <bean class="org.opensaml.util.xml.BasicParserPool"
> init-method="initialize"/>
> </property>
> <property name="source">
> <bean class="java.io.File">
> <constructor-arg
> value="/Users/Dan/workspace/metadata_aggregator/entities"/>
> </bean>
> </property>
> <property name="recurseDirectories" value="true"/>
> </bean>
>
> <bean id="removeContactPerson"
> class="net.shibboleth.metadata.dom.saml.RemoveContactPersonStage">
> <property name="id" value="removeContactPerson"/>
> </bean>
>
> <bean id="removeOrganization"
> class="net.shibboleth.metadata.dom.saml.RemoveOrganizationStage">
> <property name="id" value="removeOrganization"/>
> </bean>
>
> <bean id="createEntitiesDescriptor"
> class="net.shibboleth.metadata.dom.saml.EntitiesDescriptorAssemblerStage">
> <property name="id" value="createEntitiesDescriptor"/>
> </bean>
>
> <bean id="signMetadata"
> class="net.shibboleth.metadata.dom.stage.XMLSignatureSigningStage">
> <property name="id" value="signMetadata"/>
> <property name="privateKey"
> value="/Users/Dan/workspace/metadata_aggregator/sp-key.pem"/>
> </bean>
>
> <!-- Next we define a pipeline with all the stages in it -->
> <bean id="pipeline" class="net.shibboleth.metadata.pipeline.SimplePipeline">
> <property name="id" value="pipeline"/>
> <property name="stages">
> <list>
> <ref bean="source"/>
> <ref bean="removeContactPerson"/>
> <ref bean="removeOrganization"/>
> <ref bean="createEntitiesDescriptor"/>
> <ref bean="signMetadata"/>
> </list>
> </property>
> </bean>
>
> <!-- Lastly we define a serializer that can write out our metadata -->
> <bean id="serializer"
> class="net.shibboleth.metadata.dom.DomMetadataSerializer"/>
>
> </beans>
>
> --
>
> Thanks,
>
> Dan McLaughlin
> --
> To unsubscribe from this list send an email to dev-unsubscribe at shibboleth.net
>
--
Chad La Joie
www.itumi.biz
trusted identities, delivered
--
To unsubscribe from this list send an email to dev-unsubscribe at shibboleth.net
More information about the dev
mailing list