OpenSAML ValidationException in 2.5.1 when using signResponses="conditional"

[Cantor, Scott]

On 9/13/11 5:14 PM, "Christopher Bongaarts" <cab at umn.edu> wrote:

>When changing the OpenSAML jar for an app from 2.5.0 to 2.5.1, we
>started getting this error message when trying to validate the signature
>of a SAML2 AuthnResponse:

Regardless of which version it is, there would need to be a cached DOM for
the signature to verify, but this may be a sign there's an ordering issue
in their code. In the broken version, the SignatureProfileValidator step
probably did not. It now does (that's related to the security fix).

>We haven't seen this occur on any other SPs, so I'm guess that this app
>is not quite calling OpenSAML correctly (i.e. to get the DOM cached
>before calling o.o.s.s.validate...)

I wouldn't necessarily say it's broken in the sense of not using the
library correctly, but it may just be hitting a glitch as a result of some
unstated assumptions changing.

>Any ideas what this could be?

Just what the error says, they need to marshall the object before
verifying it.

-- Scott