Signing multiple objects?

[Brent Putman]

On 10/30/11 7:42 AM, Brad Cox wrote:
> Thanks, just what I need. Just one more question (I hope ;).
> 
> In
> xmltooling/src/test/java/org/opensaml/xml/signature/EnvelopedSignatureTest.java
> everything starts from SimpleXMLObject sxo =
> getXMLObjectWithSignature(), 


Well, the SimpleXMLObject is just a mock XMLObject provider that we use
for testing some things.  It's not relevant at all to actually writing
real code.  I don't even think it's available outside of the test classpath.


> which
> is the unsigned message envelope in my case. I have that parsed as a
> Document,
> but am stuck on how to marshal that, and to what. Test isn't very easy
> to follow due 
> to deep nesting.


For info on the basics of building, marshalling and unmarshalling, you
should first check out the OpenSAML User's Guide:

https://wiki.shibboleth.net/confluence/display/OpenSAML/OSTwoUserManual

If that doesn't answer your questions, let us know.


> 
> I found a SAML1.1 EnvelopeBuilder but this needs to be SAML 2.0. Or is
> XMLObjectBuilder
> what I need in this case?

As Scott already pointed out, that is apples and oranges.  I think you
meant SOAP 1.1 Envelope* classes.  A SAML (1.1 or 2.0) protocol message
payload, or any other payload, would merely be set as the child of the
Body of such an Envelope.

In terms of the Signature stuff, you'd be using the XML Security support
we have (package org.opensaml.ws.wssecurity). Sounds like you'd be
adding a soap11:Envelope/soap11:Header/wsse:Security header and then
likely adding a ds:Signature underneath there (as well as wsu:Timestamp
and wsa:MessageID since you mentioned those).  That's all fairly basic
use of OpenSAML XML Object providers - just obtain a builder of the
appropriate type, populate its data appropriately, and set the object as
the child of the appropriate parent object.

The complexity arises from the ds:SignedInfo/ds:Reference element(s)
that you might need to add, but sounds like Scott is advocating a single
ds:Reference with a URI="".  That corresponds in our library to a
org.opensaml.xml.signature.URIContentReference, with an empty string
reference ID (construtor arg).  You'll also have to supply the right
digest method and transform(s) tot eh URIContentReference, based on
whatever requirements the consumer (DOD?) specifies.  Note that if you
do whole-document signing as Scott advocates, you'll minimally need the
enveloped signature transform. (Traditionally WS-S signatures are
usually detached, and not enveloped, since they don't sign the whole
document or Envelope, but instead specific headers and/or the Body.  But
in this case you'd be doing enveloped).

That should get you started, let us know if you have further questions.