Signature validation fails

[Brent Putman]

On 9/29/11 10:32 AM, Cantor, Scott wrote:

> 
> The linefeeds come from xmlsec. If they're missing on the receiving end,
> you have code somewhere on one end or the other that's removing them.


Assuming we're talking about Java xmlsec here:  that's true, by default,
but I just wanted to note that recent versions of Java OpenSAML at least
attempt to set the xmlsec system property that causes no line breaks to
be emitted.  I say attempts, because xmlsec only evals the system
property once, so if something were to cause it to be evaled before you
run OpenSAML DefaultBootstrap where the system property is set, then it
wouldn't have any effect.

But for example in a plain old Shibboleth IdP, without other stuff
running OpenSAML in the container, xmlsec shouldn't ordinarily emit line
breaks.