OpenSAML ValidationException in 2.5.1 when using signResponses="conditional"

[Brent Putman]

On 9/14/11 3:56 PM, Cantor, Scott wrote:
> On 9/14/11 3:44 PM, "Christopher Bongaarts" <cab at umn.edu> wrote:
>>
>> I am still curious why signing the assertions instead of the response as
>> a whole changes the behavior here
> 
> Depends on their code, I guess. The marshalling must take place between
> those points. Presumably they eventually marshall the response, and that
> marshalls the assertions, so by the time that code runs, it's been done.
>


I think their app is definitely doing something odd with OpenSAML.  They
shouldn't need to marshall anything, the DOM should be there from the
unmarshalling process around the received Response.  They must be
dropping the DOM at some point, or something they are doing is causing
that as a side effect.  Note they can't meaningfully marshall anything
here, b/c then the signature would no longer be there.  Assuming I'm
understanding correctly here the who/what (an SP processing a Response
from an IdP).

Signing the response vs the assertion shouldn't change anything here.
If anything, the signed Assertion case might be more likely to be
problematic, if it was encrypted; in that case, there's a subtlety to
decrypting it and then validating the enveloped signature on it.

So yeah, I think the app's use of OpenSAML has some problem somewhere.