Signing multiple objects?

[Brent Putman]

On 11/1/11 8:47 PM, Brad Cox wrote:
> Got it. My problem was confusing building with unmarshalling. May be
> closing in on it.

Ok, that code below looks more correct.  I also wasn't clear that you
were starting with a DOM from elsewhere, and were then adding stuff to
it using OpenSAML.  Unmarshalling an XMLObject tree around that Envelope
Element as the first step is the right way to go.

>
> The attachSamlAssertion method now fails in
> the Signer.signObject(signature) call because signature.XMLSignature
> is null. 
>
>     ERROR11691mainDisaBlueprintSamlProcessorTest.java:76Exceptioncom.technica.xacml2.runtime.XacmlFault:
>     XMLObject does not have an XMLSignature instance, unable to
>     compute signature
>
>
> Debugger shows XMLSignature variable is indeed null but the Signature
> interface has no way to set it. SignatureImpl does, but not sure I
> should use that and don't know what to set it to.


Right, I think you're close now.  You're just forgetting to marshall
everything before you sign with the Signer.  The Apache xmlsec
XMLSignature instance isn't settable, it's created by the marshalling
process.  It's not intended that manipulate or access it.


>
> public void attachSamlAssertion(Document document)
> {
> Element envelopeElmt = document.getDocumentElement();
> try
> {
> UnmarshallerFactory unmarshallerFactory =
> Configuration.getUnmarshallerFactory();
> Unmarshaller unmarshaller =
> unmarshallerFactory.getUnmarshaller(envelopeElmt);
> XMLObject envelopeObj = unmarshaller.unmarshall(envelopeElmt);
> Envelope envelope = (Envelope) envelopeObj;
>
> <snip>
>
> Assertion assertion = newAssertion();
> security.getUnknownXMLObjects().add(assertion);
>


Just insert a call to marshall the envelope XMLObject right here, prior
to signing.  Much of that tree is alread marshalled, but the new
Security, Signature, etc that you've added are not, so (re-) marshalling
the whole Envelope XMLObject will take care of that.


> Signer.signObject(signature);
>




> Here's how I'm building the signature:
>

Off-hand, that looks ok.



-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/dev/attachments/20111102/c164e6a1/attachment-0001.html