Metadata Aggregator - Issues with XMLSignatureSigningStage

[Chad La Joie]

Alright.  The xmlsec developer responded pretty quickly.

You can endorse xmlsec but you also have to add the Apache commons
logging jar[1] to the endorsed directory as well.  I've tried this and
it works okay and does support SHA256 and other algos.  I do have some
reservations about the full impact of putting "random" jars in the
endorsed directory but for a command line tool at least it'll be fine.

[1] http://commons.apache.org/logging/download_logging.cgi

On Wed, Nov 2, 2011 at 12:27, Chad La Joie <lajoie at itumi.biz> wrote:
> I think you'll have to stick with SHA1 for now.
>
> While the xmlsec library does implement the JSR 105 APIs, it makes the
> assumption Apache's logging libraries are going to be present, which
> obviously they aren't within the JVM's system classloader.  I'll need
> to talk with them about it.  We may be ale to do something within our
> code to force the xmlsec JSR105 implementation, but I'd rather not do
> that.  Kind of defeats the purpose of using a standard API.
>
> On Wed, Nov 2, 2011 at 11:52, Krug, Jeff <Jeff.Krug at gtri.gatech.edu> wrote:
>> I tried that earlier as well, but the whole thing just blew up with some Spring bean errors:
>>
>> 2011-11-02 11:50:16,271 - ERROR [net.shibboleth.metadata.cli.SimpleCommandLine:68] - Unable to initialize Spring context
>> org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'main' defined in URL [file:/home/jk90/src/aggregator-cli-0.6.1/config1.xml]: Invocation of init method failed; nested exception is java.lang.NoClassDefFoundError: org/apache/commons/logging/LogFactory
>>        at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.initializeBean(AbstractAutowireCapableBeanFactory.java:1420) ~[spring-beans-3.0.5.RELEASE.jar:3.0.5.RELEASE]
>>
>>
>>
>> ________________________________________
>> From: dev-bounces at shibboleth.net [dev-bounces at shibboleth.net] on behalf of Chad La Joie [lajoie at itumi.biz]
>> Sent: Wednesday, November 02, 2011 11:46 AM
>> To: Shib Dev
>> Subject: Re: Metadata Aggregator - Issues with XMLSignatureSigningStage
>>
>> Okay, I wasn't able to find  the list of what algos are actually
>> supported (I can never find those lists, Brent probably knows where
>> they are).
>>
>> So, there's a fairly easy way to test this.  Endorse the santuario
>> library.  Just copy the xmlsec-1.4.5.jar in to your endorsed directory
>> where the xerces and xalan jars should be.  Then try again.
>>
>> On Wed, Nov 2, 2011 at 11:21, Chad La Joie <lajoie at itumi.biz> wrote:
>>> Well, with the metadata aggregator we made our first move to using the
>>> Java XML DSIG APIs.  My initial guess is that the implementation that
>>> ships with the JVM doesn't support anything but the what is explicitly
>>> defined in the DSIG spec.  I'll dig in to it a bit.
>>>
>>> On Wed, Nov 2, 2011 at 11:04, Krug, Jeff <Jeff.Krug at gtri.gatech.edu> wrote:
>>>> I did have one question regarding signing algorithm.  Using the xmlsectool-1.1.4 I tweaked it to default to SHA256 signatures (and it uses Apache's digital signature classes to do this).  This worked fine.  The aggregator defaults to SHA256 (although conveniently configurable via a property) using the javax.crypto libraries, but for this I get the following error:
>>>>
>>>> 2011-11-02 10:52:30,398 - ERROR [net.shibboleth.metadata.dom.XMLSignatureSigningStage:644] - Unable to create signature method http://www.w3.org/2001/04/xmldsig-more#rsa-sha256
>>>> java.security.NoSuchAlgorithmException: unsupported algorithm
>>>>        at org.jcp.xml.dsig.internal.dom.DOMXMLSignatureFactory.newSignatureMethod(Unknown Source) ~[na:1.6.0_16]
>>>>        at net.shibboleth.metadata.dom.XMLSignatureSigningStage.buildSignedInfo(XMLSignatureSigningStage.java:641) [aggregator-pipeline-0.6.1.jar:na]
>>>>
>>>> I can set it to use SHA1 via the property and it works fine, but I feel like there is something obvious I'm overlooking that needs to be done to support SHA256 (and better, the same type of error shows up for SHA384 and SHA512).
>>>
>>> --
>>> Chad La Joie
>>> www.itumi.biz
>>> trusted identities, delivered
>>>
>>
>>
>>
>> --
>> Chad La Joie
>> www.itumi.biz
>> trusted identities, delivered
>> --
>> To unsubscribe from this list send an email to dev-unsubscribe at shibboleth.net
>> --
>> To unsubscribe from this list send an email to dev-unsubscribe at shibboleth.net
>>
>
>
>
> --
> Chad La Joie
> www.itumi.biz
> trusted identities, delivered
>



-- 
Chad La Joie
www.itumi.biz
trusted identities, delivered