Signing multiple objects?

[Brent Putman]

On 11/2/11 4:30 PM, Brad Cox wrote:
> Great news. It works; generates headers and validates same. Truly
> grateful for all the help!! Two questions remain tho (surprise! ;). 
> 
> *The doubled marshalling calls, before/after signing, are essential
> acc'd the debugger, but are troubling. Is this just an accident of
> OpenSAML history, or truly essential to the nature of the problem? I can
> live with it either way; just askin'


I haven't had time to fully look into this question yet, but in general
the intention is that, no, you shouldn't have to do this.  I need to
analyze your example more closely to undertand what's going on.
Off-hand, you should be able to get what you want by using the 2-arg
marshaller that takes a Document, but if that's not working...


> 
> *The second is in the signature validation code shown below. The comment
> is from the instructions. However when the
>  SAMLSignatureProfileValidator call is enabled, it fails with "Signature
> is not an immedidate child of a SignableSAMLObject. Right, knew that,
> its a child of Security which isn't a SignableSAMLObject. But is there a
> way to salvage the protections of this function for my use case? *


Yeah, this one is easier to answer, at least.  You are not signing under
the SAML signature profile.  You're not even doing SAML signing, as I
mentioned in a  previous thread.  You're doing WS-Security SOAP message
signing.  Totally different cases.  And Scott's original point was,
there really isn't any such (sufficiently defined) WS-S profile that you
can really leverage.  So you can certainly implement implement a
validator for some "profile" that you invent, but it probably won't have
much in common with the SAML signature profile.