Signature validation fails

[Nicolas Peifer]

Chad La Joie wrote:
> Start here:
> https://wiki.shibboleth.net/confluence/display/OpenSAML/OSTwoUserManSigErro
> rs
Oh, thank you. I did not see this :(

So i tried several things and i think i know where the problem is - but i 
can't solve this:

The signature that i created is correct as i checked it with the oxygen xml 
editor (this is my signed AuthnRequest: http://paste.kde.org/128779/raw/).

After loading the AuthnRequest from a file and unmarshalling it the 
AuthnRequest is not formatted as above but it looks like this: 
http://paste.kde.org/128791/raw/

This unmarshalled AuthnRequest contains everything in a single in contrast to 
the freshly signed one. This is the only difference - and i guess that this 
causes the trouble because line breaks do matter with regard to the xml 
signature. It turned out that these line breaks are added after you set a new 
request signature AND then you marshall the request.

I tried to execute some normalize() methods (everywhere) but it didn't help. I 
use the following two helper methods to convert the request into a string 
(they both produce the same output): http://paste.kde.org/128797/

What do you think? Is my analysis correct (and how could you solve this)?

Regards
Nicolas



> 
> On Tue, Sep 27, 2011 at 11:00, Nicolas Peifer <nicolaspeifer at gmx.de> wrote:
> > Hello,
> > 
> > I'm totally lost as the signature validation fails after I have parsed my
> > AuthnRequest.
> > 
> > It is strange - the validation works if I parse the AuthnRequest, create
> > the signature and validate it directly.
> > 
> > I tried several things including printing the parsed AuthnRequest and the
> > signed one - the <ds:SignatureValue> is the same so it is not
> > understandable why the validation fails.
> > 
> > This is the AuthnRequest: http://paste.kde.org/127735/
> > 
> > This is the code which calculated the signature:
> > http://paste.kde.org/127741/
> > 
> > This is the code which validates the signature:
> > http://paste.kde.org/127747/
> > 
> > Has anyone an hint or idea what could be wrong?
> > 
> > Regards
> > Nicolas
> > --
> > --
> > To unsubscribe from this list send an email to
> > dev-unsubscribe at shibboleth.net