OpenSAML and Apache Santuario (xmlsec) 1.5.1

[Brent Putman]

On 4/12/12 1:23 PM, Stephanie Stroka wrote:
>
>
> I'm using SAML2 and the problem shows for both: Assertions and
> Responses. I tried manually setting the ID by using
>
> xmlObj.getDOM().getDocumentElement().setIdAttribute("ID", true)
>

That's not the correct method, actually.  With all the DOM methods, you
need to use the namespace aware one (ending in "NS"), so here that would
be setIdAttributeNS.   I think the behavior is undefined if you mix
usage of the namespace-aware and non-namespace aware methods in the DOM API.

> but this only helps partially (I fixed one of my tests with that).

Maybe using the -NS one will fix that.  I'd be interested to hear back
what you find.


> It's strange because when I call the setIdAttribute(..) directly
> before doc.getElementById() it works. Maybe there are some
> modifications done on the DOM tree (copying or some such) so that it
> does not remember that "ID" is an id?

That would definitely cause it.  I can't think of where or how that
would be happening in OpenSAML itself, but it's possible.  Perhaps it's
a side effect of how you are running this.  Can you provide more details
- are you just parsing and unmarshalling the XML from a file and then
validating the signature?  Are there any intervening operations?  Are
you instead programatically building, marshalling and signing, and then
validating that same XMLObject?  Or something else?


>
> BTW:  The org.opensaml.security.SAMLSignatureProfileValidator still
> uses IdResolver.getElementById(doc, uriID) (line 150).

Yeah, as Scott says, that was a conscious decision, to use the same
logic as the underlying signature validation code, to defeat certain
kinds of attacks.