OpenSAML and Apache Santuario (xmlsec) 1.5.1

[Brent Putman]

On 4/12/12 1:12 PM, Brent Putman wrote:
> I have not tried running OpenSAML v2 with the newer Santuario yet.  I'll
> do some quick tests later today or tomorrow to see if I experience the
> same issue.

I did some testing. I was not able to reproduce this by just switching
OpenSAML 2 to use 1.5.1.  All our signature signing and validation tests
work fine for me.

Your and Scott's comments about the SAML signature profile validator
made me realize that the ID-ness of the attributes and their resolution
can't be fundamentally broken in OpenSAML, and the Santuario IdResolver
must be finding the ID's by DOM search and not by the fallback behavior
that was removed in 1.5.0.  If that were the case, we'd be seeing
routine failures of things in the profile validator, which uses the DOM
search exclusively, before it even attempted to validate the signature.

I also confirmed this by turning on DEBUG logging level for category:
org.apache.xml.security.utils.IdResolver.  With 1.4.x, I  see output
similar to the following:

DEBUG IdResolver - getElementByIdType() Search for ID
_b32801700a13922734aeb359f296ddac
DEBUG IdResolver - getElementByIdUsingDOM() Search for ID
_b32801700a13922734aeb359f296ddac
DEBUG IdResolver - I could find an Element using the simple
getElementByIdUsingDOM method: saml2:Assertion

The line about getElementByIdType() is a little misleading - looking at
code, what that really does is attempt to resolve from the IdResolver
cache, nothing more.  The last line indicates a successful resolution
via the DOM method (despite the slightly awkward English phrasing there).

In order to troubleshoot what's going on in your environment, you might
try reverting back to 1.4.x, and turning on the debug logging above.  I
suspect you'll see the first 2 lines, but not the "I could find..."
line, which would mean the DOM search is failing.  Unfortunately, it
doesn't explicitly log anything when it then does the manual search
against well-known namespaces, but the absence of the "I could find..."
line in conjunction with a successful resolution and signature
validation would confirm that is what it's doing.

Also, if you are running the SAMLSignatureProfileValidator, it shouldn't
matter what version of Santuario you are using.  The DOM search there
should fail if the ID-ness is lost, so that could be an indication of
the problem.

Since it's been working for a large number of people, I'd suspect
either: 1) something you are doing after parsing but before validation
is changing the DOM, as you earlier suggested or 2) an environment issue
with your XML parsing environment.  Can you check and confirm what
version of Xerces and Xalan you are using, and that you have properly
endorsed them in your JVM per our install instructions?  If there is an
issue with some combination of Xerces and Xalan, or a bug in some
version of those libraries, we'd love to uncover that.

Also, on what JRE vendor, version and OS platform are you seeing this error?