Metadata Aggregator - Issues with XMLSignatureSigningStage

[Krug, Jeff]

As one other note, there is a typo on line 168 of the config3.xml example.  It should be readLocalMetadata instead of readUkMetadata...  Although that doesn't really reduce it's usefulness as an example! 

Thanks,
Jeff

________________________________________
From: dev-bounces at shibboleth.net [dev-bounces at shibboleth.net] on behalf of Krug, Jeff [Jeff.Krug at gtri.gatech.edu]
Sent: Wednesday, November 02, 2011 11:52 AM
To: Shib Dev
Subject: RE: Metadata Aggregator - Issues with XMLSignatureSigningStage

I tried that earlier as well, but the whole thing just blew up with some Spring bean errors:

2011-11-02 11:50:16,271 - ERROR [net.shibboleth.metadata.cli.SimpleCommandLine:68] - Unable to initialize Spring context
org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'main' defined in URL [file:/home/jk90/src/aggregator-cli-0.6.1/config1.xml]: Invocation of init method failed; nested exception is java.lang.NoClassDefFoundError: org/apache/commons/logging/LogFactory
        at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.initializeBean(AbstractAutowireCapableBeanFactory.java:1420) ~[spring-beans-3.0.5.RELEASE.jar:3.0.5.RELEASE]



________________________________________
From: dev-bounces at shibboleth.net [dev-bounces at shibboleth.net] on behalf of Chad La Joie [lajoie at itumi.biz]
Sent: Wednesday, November 02, 2011 11:46 AM
To: Shib Dev
Subject: Re: Metadata Aggregator - Issues with XMLSignatureSigningStage

Okay, I wasn't able to find  the list of what algos are actually
supported (I can never find those lists, Brent probably knows where
they are).

So, there's a fairly easy way to test this.  Endorse the santuario
library.  Just copy the xmlsec-1.4.5.jar in to your endorsed directory
where the xerces and xalan jars should be.  Then try again.

On Wed, Nov 2, 2011 at 11:21, Chad La Joie <lajoie at itumi.biz> wrote:
> Well, with the metadata aggregator we made our first move to using the
> Java XML DSIG APIs.  My initial guess is that the implementation that
> ships with the JVM doesn't support anything but the what is explicitly
> defined in the DSIG spec.  I'll dig in to it a bit.
>
> On Wed, Nov 2, 2011 at 11:04, Krug, Jeff <Jeff.Krug at gtri.gatech.edu> wrote:
>> I did have one question regarding signing algorithm.  Using the xmlsectool-1.1.4 I tweaked it to default to SHA256 signatures (and it uses Apache's digital signature classes to do this).  This worked fine.  The aggregator defaults to SHA256 (although conveniently configurable via a property) using the javax.crypto libraries, but for this I get the following error:
>>
>> 2011-11-02 10:52:30,398 - ERROR [net.shibboleth.metadata.dom.XMLSignatureSigningStage:644] - Unable to create signature method http://www.w3.org/2001/04/xmldsig-more#rsa-sha256
>> java.security.NoSuchAlgorithmException: unsupported algorithm
>>        at org.jcp.xml.dsig.internal.dom.DOMXMLSignatureFactory.newSignatureMethod(Unknown Source) ~[na:1.6.0_16]
>>        at net.shibboleth.metadata.dom.XMLSignatureSigningStage.buildSignedInfo(XMLSignatureSigningStage.java:641) [aggregator-pipeline-0.6.1.jar:na]
>>
>> I can set it to use SHA1 via the property and it works fine, but I feel like there is something obvious I'm overlooking that needs to be done to support SHA256 (and better, the same type of error shows up for SHA384 and SHA512).
>
> --
> Chad La Joie
> www.itumi.biz
> trusted identities, delivered
>



--
Chad La Joie
www.itumi.biz
trusted identities, delivered
--
To unsubscribe from this list send an email to dev-unsubscribe at shibboleth.net
--
To unsubscribe from this list send an email to dev-unsubscribe at shibboleth.net