OpenSAML ValidationException in 2.5.1 when using signResponses="conditional"

[Christopher Bongaarts]

Cantor, Scott wrote:
> On 9/13/11 5:14 PM, "Christopher Bongaarts" <cab at umn.edu> wrote:
> 
>> When changing the OpenSAML jar for an app from 2.5.0 to 2.5.1, we
>> started getting this error message when trying to validate the signature
>> of a SAML2 AuthnResponse:
> 
> Regardless of which version it is, there would need to be a cached DOM for
> the signature to verify, but this may be a sign there's an ordering issue
> in their code. In the broken version, the SignatureProfileValidator step
> probably did not. It now does (that's related to the security fix).
> 
>> We haven't seen this occur on any other SPs, so I'm guess that this app
>> is not quite calling OpenSAML correctly (i.e. to get the DOM cached
>> before calling o.o.s.s.validate...)
> 
> I wouldn't necessarily say it's broken in the sense of not using the
> library correctly, but it may just be hitting a glitch as a result of some
> unstated assumptions changing.
> 
>> Any ideas what this could be?
> 
> Just what the error says, they need to marshall the object before
> verifying it.

I am still curious why signing the assertions instead of the response as 
a whole changes the behavior here (and also curious what the security 
ramifications are of doing so - i.e. is this really a valid workaround?).

We'll also follow up with the app folks.

-- 
%%  Christopher A. Bongaarts   %%  cab at umn.edu          %%
%%  OIT - Identity Management  %%  http://umn.edu/~cab  %%
%%  University of Minnesota    %%  +1 (612) 625-1809    %%