OpenSAML and Apache Santuario (xmlsec) 1.5.1

[Stephanie Stroka]

Hello everyone,

I was trying to upgrade the xmlsec library from version 1.4.4 to 1.5.1 
due to another library that depends on the new version.
There are some changes that have been made to the new version of xmlsec, 
e.g. how Elements are resolved.

The blog post 
http://coheigea.blogspot.com/2012/01/apache-santuario-xml-security-for-java.html 
gives an overview of the changes.

I tried openSAML 2.5.1 with xmlsec 1.5.1 and it fails because 
org.w3c.dom.Document.getElementById(String id) does not resolve any 
element anymore. The stack trace that I got is the following:

org.apache.xml.security.utils.resolver.ResourceResolverException: Cannot 
resolve element with ID Response_0429a9ae645e7a9f06533443bf6d9e33bd4abeea
     [junit]     at 
org.apache.xml.security.utils.resolver.implementations.ResolverFragment.engineResolve(ResolverFragment.java:86)
     [junit]     at 
org.apache.xml.security.utils.resolver.ResourceResolver.resolve(ResourceResolver.java:279)
     [junit]     at 
org.apache.xml.security.signature.Reference.getContentsBeforeTransformation(Reference.java:432)
     [junit]     at 
org.apache.xml.security.signature.Reference.dereferenceURIandPerformTransforms(Reference.java:614)
     [junit]     at 
org.apache.xml.security.signature.Reference.calculateDigest(Reference.java:705)
     [junit]     at 
org.apache.xml.security.signature.Reference.verify(Reference.java:761)
     [junit]     at 
org.apache.xml.security.signature.Manifest.verifyReferences(Manifest.java:336)
     [junit]     at 
org.apache.xml.security.signature.SignedInfo.verify(SignedInfo.java:259)
     [junit]     at 
org.apache.xml.security.signature.XMLSignature.checkSignatureValue(XMLSignature.java:724)
     [junit]     at 
org.opensaml.xml.signature.SignatureValidator.validate(SignatureValidator.java:68)
     [junit]     at 
ch.nevis.esauth.auth.states.saml.Toolbox.verifyXMLSignature(Toolbox.java:1657) 



I was wondering how elements were resolved in the previous version. Was 
it enough to set the id for an assertion?
Is OpenSAML planning to migrate to xmlsec 1.5.1?
And: Do you have any suggestions on how to make it possible that 
elements can be resolved without digging into the OpenSAML library?


Thanks and best wishes,
Steffi