Signing multiple objects?

[Chad La Joie]

Our SAML signing stuff just builds, and restricts options down to the
SAML signature profile, the signature code in xmltooling.  And yes,
there is a content reference mechanism in the code and the base
signature code can take any number of them.

On Tue, Oct 25, 2011 at 09:10, Cantor, Scott <cantor.2 at osu.edu> wrote:
> On 10/25/11 6:40 AM, "Brad Cox" <bradjcox at gmail.com> wrote:
>>
>>I'd rather not have this restriction, of course, and that the solution be
>>fully interoperable. But the signing spec is so over to the top in this
>>case that I'd be happy to get something that works at all. The spec is
>>far beyond what any impl I know of will support.
>>
>>Any suggestions on where to start?
>
> Well, you're basically on your own implementing that. You'd need to
> manually deal with the signature. You could probably use the existing SAML
> shortcuts as an example. I believe the Java code is like mine and has a
> ContentReference abstraction that was intended to encapsulate the
> signature reference and transforms needed, but worst case you'd be coding
> directly to the signature APIs.
>
> If you're asking what the signature needs to be, you'd need to read the
> XML Signature standard. A WS-Security signature is normally a
> multi-reference enveloped signature. As I said, if you want it to work,
> I'd sign the whole document.
>
> -- Scott
>
> --
> To unsubscribe from this list send an email to dev-unsubscribe at shibboleth.net
>



-- 
Chad La Joie
www.itumi.biz
trusted identities, delivered