Signing multiple objects?

[Brad Cox]

Thanks, Brent. Very helpful. I discovered some of this myself over the
weekend, even the URIContentReference stuff, and got it to sign and
validate one of my test cases (an XACMLAuthzRequest inside an Envelope).
The test case is EnvelopedSignatureTest, renamed SignableSoapEnvelopeTest,
and based on SignableSoapEnvelope (below).


Since Envelope lacks a setSignature method I created a wrapper to provide
one plus setHeader and setBody methods.


   - public class SignableSoapEnvelope extends AbstractSignableXMLObject
      - implements ElementExtensibleXMLObject, AttributeExtensibleXMLObject

Is this on the right path? Or should this be AbstractSignableSOAPObject?
I'm unclear on the difference so have been exploring both paths. The
pointer to ws.wssecurity sounds promising. Have been focusing on xmltooling
on the (mis)understanding that OpenSAML doesn't handle SAML2 signing yet.
I'll look at that next.
Current problem is that when I sign an Envelope with header and/or body
contents, the contents disappear during the signing step. I believe this is
because EnvelopeMarshaller, HeaderMarshaller and BodyMarshaller are not
expecting signatures or contents; for example EnvelopeMarshaller

    protected void marshallElementContent(XMLObject xmlObject, Element
domElement) throws MarshallingException {

// nothing to do, not element content

    }

I plan to explore whether extending the marshalElementContent methods might
get me a bit further.





On Mon, Oct 31, 2011 at 3:53 PM, Brent Putman <putmanb at georgetown.edu>wrote:

>
>
> On 10/30/11 7:42 AM, Brad Cox wrote:
> > Thanks, just what I need. Just one more question (I hope ;).
> >
> > In
> >
> xmltooling/src/test/java/org/opensaml/xml/signature/EnvelopedSignatureTest.java
> > everything starts from SimpleXMLObject sxo =
> > getXMLObjectWithSignature(),
>
>
> Well, the SimpleXMLObject is just a mock XMLObject provider that we use
> for testing some things.  It's not relevant at all to actually writing
> real code.  I don't even think it's available outside of the test
> classpath.
>
>
> > which
> > is the unsigned message envelope in my case. I have that parsed as a
> > Document,
> > but am stuck on how to marshal that, and to what. Test isn't very easy
> > to follow due
> > to deep nesting.
>
>
> For info on the basics of building, marshalling and unmarshalling, you
> should first check out the OpenSAML User's Guide:
>
> https://wiki.shibboleth.net/confluence/display/OpenSAML/OSTwoUserManual
>
> If that doesn't answer your questions, let us know.
>
>
> >
> > I found a SAML1.1 EnvelopeBuilder but this needs to be SAML 2.0. Or is
> > XMLObjectBuilder
> > what I need in this case?
>
> As Scott already pointed out, that is apples and oranges.  I think you
> meant SOAP 1.1 Envelope* classes.  A SAML (1.1 or 2.0) protocol message
> payload, or any other payload, would merely be set as the child of the
> Body of such an Envelope.
>
> In terms of the Signature stuff, you'd be using the XML Security support
> we have (package org.opensaml.ws.wssecurity). Sounds like you'd be
> adding a soap11:Envelope/soap11:Header/wsse:Security header and then
> likely adding a ds:Signature underneath there (as well as wsu:Timestamp
> and wsa:MessageID since you mentioned those).  That's all fairly basic
> use of OpenSAML XML Object providers - just obtain a builder of the
> appropriate type, populate its data appropriately, and set the object as
> the child of the appropriate parent object.
>
> The complexity arises from the ds:SignedInfo/ds:Reference element(s)
> that you might need to add, but sounds like Scott is advocating a single
> ds:Reference with a URI="".  That corresponds in our library to a
> org.opensaml.xml.signature.URIContentReference, with an empty string
> reference ID (construtor arg).  You'll also have to supply the right
> digest method and transform(s) tot eh URIContentReference, based on
> whatever requirements the consumer (DOD?) specifies.  Note that if you
> do whole-document signing as Scott advocates, you'll minimally need the
> enveloped signature transform. (Traditionally WS-S signatures are
> usually detached, and not enveloped, since they don't sign the whole
> document or Envelope, but instead specific headers and/or the Body.  But
> in this case you'd be doing enveloped).
>
> That should get you started, let us know if you have further questions.
>
>
> --
> To unsubscribe from this list send an email to
> dev-unsubscribe at shibboleth.net
>



-- 
Cell: 703-594-1883
Blog: http://bradjcox.blogspot.com
Web: http://virtualschool.edu
Manassas VA 20111
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/dev/attachments/20111031/c4aab391/attachment.html