Metadata Aggregator - Issues with XMLSignatureSigningStage

[Chad La Joie]

I think you'll have to stick with SHA1 for now.

While the xmlsec library does implement the JSR 105 APIs, it makes the
assumption Apache's logging libraries are going to be present, which
obviously they aren't within the JVM's system classloader.  I'll need
to talk with them about it.  We may be ale to do something within our
code to force the xmlsec JSR105 implementation, but I'd rather not do
that.  Kind of defeats the purpose of using a standard API.

On Wed, Nov 2, 2011 at 11:52, Krug, Jeff <Jeff.Krug at gtri.gatech.edu> wrote:
> I tried that earlier as well, but the whole thing just blew up with some Spring bean errors:
>
> 2011-11-02 11:50:16,271 - ERROR [net.shibboleth.metadata.cli.SimpleCommandLine:68] - Unable to initialize Spring context
> org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'main' defined in URL [file:/home/jk90/src/aggregator-cli-0.6.1/config1.xml]: Invocation of init method failed; nested exception is java.lang.NoClassDefFoundError: org/apache/commons/logging/LogFactory
>        at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.initializeBean(AbstractAutowireCapableBeanFactory.java:1420) ~[spring-beans-3.0.5.RELEASE.jar:3.0.5.RELEASE]
>
>
>
> ________________________________________
> From: dev-bounces at shibboleth.net [dev-bounces at shibboleth.net] on behalf of Chad La Joie [lajoie at itumi.biz]
> Sent: Wednesday, November 02, 2011 11:46 AM
> To: Shib Dev
> Subject: Re: Metadata Aggregator - Issues with XMLSignatureSigningStage
>
> Okay, I wasn't able to find  the list of what algos are actually
> supported (I can never find those lists, Brent probably knows where
> they are).
>
> So, there's a fairly easy way to test this.  Endorse the santuario
> library.  Just copy the xmlsec-1.4.5.jar in to your endorsed directory
> where the xerces and xalan jars should be.  Then try again.
>
> On Wed, Nov 2, 2011 at 11:21, Chad La Joie <lajoie at itumi.biz> wrote:
>> Well, with the metadata aggregator we made our first move to using the
>> Java XML DSIG APIs.  My initial guess is that the implementation that
>> ships with the JVM doesn't support anything but the what is explicitly
>> defined in the DSIG spec.  I'll dig in to it a bit.
>>
>> On Wed, Nov 2, 2011 at 11:04, Krug, Jeff <Jeff.Krug at gtri.gatech.edu> wrote:
>>> I did have one question regarding signing algorithm.  Using the xmlsectool-1.1.4 I tweaked it to default to SHA256 signatures (and it uses Apache's digital signature classes to do this).  This worked fine.  The aggregator defaults to SHA256 (although conveniently configurable via a property) using the javax.crypto libraries, but for this I get the following error:
>>>
>>> 2011-11-02 10:52:30,398 - ERROR [net.shibboleth.metadata.dom.XMLSignatureSigningStage:644] - Unable to create signature method http://www.w3.org/2001/04/xmldsig-more#rsa-sha256
>>> java.security.NoSuchAlgorithmException: unsupported algorithm
>>>        at org.jcp.xml.dsig.internal.dom.DOMXMLSignatureFactory.newSignatureMethod(Unknown Source) ~[na:1.6.0_16]
>>>        at net.shibboleth.metadata.dom.XMLSignatureSigningStage.buildSignedInfo(XMLSignatureSigningStage.java:641) [aggregator-pipeline-0.6.1.jar:na]
>>>
>>> I can set it to use SHA1 via the property and it works fine, but I feel like there is something obvious I'm overlooking that needs to be done to support SHA256 (and better, the same type of error shows up for SHA384 and SHA512).
>>
>> --
>> Chad La Joie
>> www.itumi.biz
>> trusted identities, delivered
>>
>
>
>
> --
> Chad La Joie
> www.itumi.biz
> trusted identities, delivered
> --
> To unsubscribe from this list send an email to dev-unsubscribe at shibboleth.net
> --
> To unsubscribe from this list send an email to dev-unsubscribe at shibboleth.net
>



-- 
Chad La Joie
www.itumi.biz
trusted identities, delivered