Signature validation fails

[Chad La Joie]

I guess I'm not sure what you're saying.  The act of unmarshalling
doesn't change the DOM in any fashion.  So, that's not what is adding
the carriage returns.  So, something is happening between the time you
generate the signature and when you unmarshall the signature.  So,
you'll need to look at the code in those areas.

On Thu, Sep 29, 2011 at 10:24, Nicolas Peifer <nicolaspeifer at gmx.de> wrote:
> Chad La Joie wrote:
>> Start here:
>> https://wiki.shibboleth.net/confluence/display/OpenSAML/OSTwoUserManSigErro
>> rs
> Oh, thank you. I did not see this :(
>
> So i tried several things and i think i know where the problem is - but i
> can't solve this:
>
> The signature that i created is correct as i checked it with the oxygen xml
> editor (this is my signed AuthnRequest: http://paste.kde.org/128779/raw/).
>
> After loading the AuthnRequest from a file and unmarshalling it the
> AuthnRequest is not formatted as above but it looks like this:
> http://paste.kde.org/128791/raw/
>
> This unmarshalled AuthnRequest contains everything in a single in contrast to
> the freshly signed one. This is the only difference - and i guess that this
> causes the trouble because line breaks do matter with regard to the xml
> signature. It turned out that these line breaks are added after you set a new
> request signature AND then you marshall the request.
>
> I tried to execute some normalize() methods (everywhere) but it didn't help. I
> use the following two helper methods to convert the request into a string
> (they both produce the same output): http://paste.kde.org/128797/
>
> What do you think? Is my analysis correct (and how could you solve this)?
>
> Regards
> Nicolas
>
>
>
>>
>> On Tue, Sep 27, 2011 at 11:00, Nicolas Peifer <nicolaspeifer at gmx.de> wrote:
>> > Hello,
>> >
>> > I'm totally lost as the signature validation fails after I have parsed my
>> > AuthnRequest.
>> >
>> > It is strange - the validation works if I parse the AuthnRequest, create
>> > the signature and validate it directly.
>> >
>> > I tried several things including printing the parsed AuthnRequest and the
>> > signed one - the <ds:SignatureValue> is the same so it is not
>> > understandable why the validation fails.
>> >
>> > This is the AuthnRequest: http://paste.kde.org/127735/
>> >
>> > This is the code which calculated the signature:
>> > http://paste.kde.org/127741/
>> >
>> > This is the code which validates the signature:
>> > http://paste.kde.org/127747/
>> >
>> > Has anyone an hint or idea what could be wrong?
>> >
>> > Regards
>> > Nicolas
>> > --
>> > --
>> > To unsubscribe from this list send an email to
>> > dev-unsubscribe at shibboleth.net
>
> --
> To unsubscribe from this list send an email to dev-unsubscribe at shibboleth.net
>



-- 
Chad La Joie
www.itumi.biz
trusted identities, delivered