Signing multiple objects?

[Brad Cox]

Great news. It works; generates headers and validates same. Truly grateful
for all the help!! Two questions remain tho (surprise! ;).

*The doubled marshalling calls, before/after signing, are essential acc'd
the debugger, but are troubling. Is this just an accident of OpenSAML
history, or truly essential to the nature of the problem? I can live with
it either way; just askin'
*
 public void attachSamlAssertion(Document document)
{
Element envelopeElmt = document.getDocumentElement();
// log.debug("Unsigned Document\n{}",
XMLHelper.prettyPrintXML(envelopeElmt));

try
 {
Unmarshaller unmarshaller =
unmarshallerFactory.getUnmarshaller(envelopeElmt);
 XMLObject envelopeObj = unmarshaller.unmarshall(envelopeElmt);

Envelope envelope = (Envelope) envelopeObj;
 Header header = envelope.getHeader();

Security security = newSecurity();
 header.getUnknownXMLObjects().add(security);

Signature signature = newSignature();
 security.getUnknownXMLObjects().add(signature);

Timestamp timestamp = newTimeStamp();
 security.getUnknownXMLObjects().add(timestamp);

MessageID messageID = newMessageID();
 security.getUnknownXMLObjects().add(messageID);

Assertion assertion = newAssertion();
 security.getUnknownXMLObjects().add(assertion);

// Looks bogus but is required to establish XMLSignature within signature.
 Marshaller marshaller1 = marshallerFactory.getMarshaller(envelope);
Element unsignedEnvelope = marshaller1.marshall(envelope, document);
// log.debug("Unsigned Document\n{}",
XMLHelper.prettyPrintXML(unsignedEnvelope));

Signer.signObject(signature);

// Required to convert to Element to set into document with
// SignatureValue and DigestValue properly set.
 Marshaller marshaller = marshallerFactory.getMarshaller(envelope);
Element signedEnvelope = marshaller.marshall(envelope, document);
// log.debug("Signed Document\n{}",
XMLHelper.prettyPrintXML(signedEnvelope));

document.adoptNode(signedEnvelope);
 document.appendChild(signedEnvelope);
return;
}
 catch (Exception e)
{
throw new XacmlFault(e);
 }
}

*The second is in the signature validation code shown below. The comment is
from the instructions. However when the  SAMLSignatureProfileValidator call
is enabled, it fails with "Signature is not an immedidate child of a
SignableSAMLObject. Right, knew that, its a child of Security which isn't a
SignableSAMLObject. But is there a way to salvage the protections of this
function for my use case? *

private void okSignature(Signature signature) throws ValidationException
{
 // In order to prevent certain types of denial-of-service attacks
// associated with signature verification, it is advisable to successfully
 // validate the Signature with the
// org.opensaml.security.SAMLSignatureProfileValidator
 // prior to attempting to cryptographically verify the signature.
//
// bcox: disabled becauase fails with "Signature is not an immedidate
 // child of a SignableSAMLObject" when Signature is attached to
// Security element (which is not a SignableSAMLObject).
// SAMLSignatureProfileValidator svpf = new SAMLSignatureProfileValidator();
// svpf.validate(signature);

SignatureValidator validator = new SignatureValidator(getCredential());
validator.validate(signature);
 }
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/dev/attachments/20111102/f1a4be8a/attachment.html