Signature verification failed
Li Run
Run.Li at gemalto.com
Mon Dec 3 20:57:16 EST 2012
Hi, all
I'm using OpenSAML to test some SAML1.1 sso. When I get a saml response from the server, I try to validate the signature of the saml assertion, but I always get the "Signature verification failed" error.
My code is like:
KeyInfoCredentialResolver keyInfoCrendentialResolver = SecurityHelper.buildBasicInlineKeyInfoResolver ();
KeyInfoCriteria criteria = new KeyInfoCriteria(signature.getKeyInfo());
CriteriaSet criteriaSet = new CriteriaSet(criteria);
Credential credential = keyInfoCrendentialResolver.resolveSingle(criteriaSet);
SignatureValidator signatureValidator = new SignatureValidator (credential);
try {
signatureValidator.validate (signature);
} catch (ValidationException e) {
// TODO Auto-generated catch block
e.printStackTrace();
}
And the saml response is like:
<samlp:Response InResponseTo="TEST0001"
IssueInstant="2007-03-14T17:44:00.629Z" MajorVersion="1"
MinorVersion="1" ResponseID="_1f32344c6519a4c109fac14b203573d0"
xmlns="urn:oasis:names:tc:SAML:1.0:protocol"
xmlns:saml="urn:oasis:names:tc:SAML:1.0:assertion"
xmlns:samlp="urn:oasis:names:tc:SAML:1.0:protocol"
xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
<samlp:Status xmlns:samlp="urn:oasis:names:tc:SAML:1.0:protocol">
<samlp:StatusCode Value="samlp:Success"/>
</samlp:Status>
<saml:Assertion AssertionID="_e63f2121a0086c9b1de84241dac79351"
IssueInstant="2007-03-14T17:43:59.085Z"
Issuer="CN=txslsaned4.nss.vzwnet.com, L=South Lake, ST=California, C=US, OU=Network Support Systems, O=Verizon Wireless"
MajorVersion="1" MinorVersion="1"
xmlns="urn:oasis:names:tc:SAML:1.0:assertion"
xmlns:saml="urn:oasis:names:tc:SAML:1.0:assertion"
xmlns:samlp="urn:oasis:names:tc:SAML:1.0:protocol"
xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
<saml:Conditions NotBefore="2007-03-14T17:43:58.686Z" NotOnOrAfter="2007-03-15T17:43:58.686Z"/>
<saml:AuthenticationStatement
AuthenticationInstant="2007-03-14T17:43:58.686Z" AuthenticationMethod="urn:oasis:names:tc:SAML:1.0:am:password">
<saml:Subject>
<saml:NameIdentifier NameQualifier="VZW SANE User">testuser</saml:NameIdentifier>
<saml:SubjectConfirmation>
<saml:ConfirmationMethod>urn:oasis:names:tc:SAML:1.0:cm:artifact</saml:ConfirmationMethod>
</saml:SubjectConfirmation>
</saml:Subject>
</saml:AuthenticationStatement>
<saml:AttributeStatement>
<saml:Subject>
<saml:NameIdentifier NameQualifier="VZW SANE User">testuser</saml:NameIdentifier>
<saml:SubjectConfirmation>
<saml:ConfirmationMethod>urn:oasis:names:tc:SAML:1.0:cm:artifact</saml:ConfirmationMethod>
</saml:SubjectConfirmation>
</saml:Subject>
<saml:Attribute AttributeName="role" AttributeNamespace="urn:oasis:names:tc:xacml:2.0:subject:role">
<saml:AttributeValue>noc3grp</saml:AttributeValue>
</saml:Attribute>
<saml:Attribute AttributeName="email" AttributeNamespace="urn:verizon:sane">
<saml:AttributeValue>Robert.Dickson at Verizonwireless.com</saml:AttributeValue<mailto:Robert.Dickson at Verizonwireless.com%3c/saml:AttributeValue>>
</saml:Attribute>
<saml:Attribute AttributeName="firstName" AttributeNamespace="urn:verizon:sane">
<saml:AttributeValue>Robert</saml:AttributeValue>
</saml:Attribute>
<saml:Attribute AttributeName="lastName" AttributeNamespace="urn:verizon:sane">
<saml:AttributeValue>Dickson</saml:AttributeValue>
</saml:Attribute>
<saml:Attribute AttributeName="phoneNumber" AttributeNamespace="urn:verizon:sane">
<saml:AttributeValue>6782773574</saml:AttributeValue>
</saml:Attribute>
<saml:Attribute AttributeName="pagerServiceNumber" AttributeNamespace="urn:verizon:sane">
<saml:AttributeValue>n/a</saml:AttributeValue>
</saml:Attribute>
<saml:Attribute AttributeName="pagerPin" AttributeNamespace="urn:verizon:sane">
<saml:AttributeValue>n/a</saml:AttributeValue>
</saml:Attribute>
<saml:Attribute AttributeName="unixUserName" AttributeNamespace="urn:verizon:sane">
<saml:AttributeValue>testuser</saml:AttributeValue>
</saml:Attribute>
<saml:Attribute AttributeName="unixUID" AttributeNamespace="urn:verizon:sane">
<saml:AttributeValue>57074</saml:AttributeValue>
</saml:Attribute>
<saml:Attribute AttributeName="unixHomeDir" AttributeNamespace="urn:verizon:sane">
<saml:AttributeValue>/export/home/57074</saml:AttributeValue>
</saml:Attribute>
<saml:Attribute AttributeName="unixLoginShell" AttributeNamespace="urn:verizon:sane">
<saml:AttributeValue>/bin/ksh</saml:AttributeValue>
</saml:Attribute>
<saml:Attribute AttributeName="role" AttributeNamespace="urn:verizon:sane">
<saml:AttributeValue>noc3grp</saml:AttributeValue>
</saml:Attribute>
</saml:AttributeStatement>
<ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#<http://www.w3.org/2000/09/xmldsig>">
<ds:SignedInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#<http://www.w3.org/2000/09/xmldsig>">
<ds:CanonicalizationMethod
Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#<http://www.w3.org/2001/10/xml-exc-c14n>" xmlns:ds="http://www.w3.org/2000/09/xmldsig#<http://www.w3.org/2000/09/xmldsig>"/>
<ds:SignatureMethod
Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" xmlns:ds="http://www.w3.org/2000/09/xmldsig#<http://www.w3.org/2000/09/xmldsig>"/>
<ds:Reference URI="#_e63f2121a0086c9b1de84241dac79351" xmlns:ds="http://www.w3.org/2000/09/xmldsig#<http://www.w3.org/2000/09/xmldsig>">
<ds:Transforms xmlns:ds="http://www.w3.org/2000/09/xmldsig#<http://www.w3.org/2000/09/xmldsig>">
<ds:Transform
Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" xmlns:ds="http://www.w3.org/2000/09/xmldsig#<http://www.w3.org/2000/09/xmldsig>"/>
<ds:Transform
Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#<http://www.w3.org/2001/10/xml-exc-c14n>" xmlns:ds="http://www.w3.org/2000/09/xmldsig#<http://www.w3.org/2000/09/xmldsig>">
<ec:InclusiveNamespaces
PrefixList="code ds kind rw saml samlp typens #default xsd xsi" xmlns:ec="http://www.w3.org/2001/10/xml-exc-c14n#<http://www.w3.org/2001/10/xml-exc-c14n>"/>
</ds:Transform>
</ds:Transforms>
<ds:DigestMethod
Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" xmlns:ds="http://www.w3.org/2000/09/xmldsig#<http://www.w3.org/2000/09/xmldsig>"/>
<ds:DigestValue xmlns:ds="http://www.w3.org/2000/09/xmldsig#<http://www.w3.org/2000/09/xmldsig>">vwj4EhSZP3eQtRIKY7qbOK25S1I=</ds:DigestValue>
</ds:Reference>
</ds:SignedInfo>
<ds:SignatureValue xmlns:ds="http://www.w3.org/2000/09/xmldsig#<http://www.w3.org/2000/09/xmldsig>">ThN1VFDHwVV2U5oxUYoseHQJufnzanYrsZmIBv/U8qMZ7/WEtSmTFun+hgFfsRKly2D8cMzBlQLrommhK24T69U0ARQiYtY2DAeypk5QiJiNyv8fozQHbhepkWJNAH6LtHGaAg1LLeFK2fkb4RXtlvugI7DA0Yd0hEM1OYhLypk=</ds:SignatureValue>
<ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#<http://www.w3.org/2000/09/xmldsig>">
<ds:X509Data xmlns:ds="http://www.w3.org/2000/09/xmldsig#<http://www.w3.org/2000/09/xmldsig>">
<ds:X509Certificate xmlns:ds="http://www.w3.org/2000/09/xmldsig#<http://www.w3.org/2000/09/xmldsig>">MIIDjTCCAnWgAwIBAgIDBKs8MA0GCSqGSIb3DQEBBQUAMIGNMRkwFwYDVQQKExBWZXJpem9uIFdpcmVsZXNzMSAwHgYDVQQLExdOZXR3b3JrIFN1cHBvcnQgU3lzdGVtczELMAkGA1UEBhMCVVMxEzARBgNVBAgTCkNhbGlmb3JuaWExEzARBgNVBAcTClNvdXRoIExha2UxFzAVBgNVBAMTDlNBTkUgTWFzdGVyIENBMB4XDTA2MTIwNDE3MTIxMFoXDTExMTIwNDE3MTIxMFowgZgxGTAXBgNVBAoTEFZlcml6b24gV2lyZWxlc3MxIDAeBgNVBAsTF05ldHdvcmsgU3VwcG9ydCBTeXN0ZW1zMQswCQYDVQQGEwJVUzETMBEGA1UECBMKQ2FsaWZvcm5pYTETMBEGA1UEBxMKU291dGggTGFrZTEiMCAGA1UEAxMZdHhzbHNhbmVkNC5uc3Mudnp3bmV0LmNvbTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEApC/VZ2YWUAb8acgS9Jbhb371Fb4TQgPVeIWiz2CtjmsOTSeIhDqdJWXd4RP21fqUToTWNW/l9IAQuOWxsQcvRZTy8aOSMrYU2M2Pw4AU0iVAj83DgSY8Z/jg7wXX4Lgfu/zadmNvSaTnkmojvWttlpvUttJLpTa0YaZrLg0YnyECAwEAAaNtMGswOQYDVR0RBDIwMIIcc2FuZTUtZGV2LnZoLmVuZy52endjb3JwLmNvbYIKdHhzbHNhbmVkNIcECtfUGTAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBQ+u2upm9M0Qjpk3wca1G46/CYedDANBgkqhkiG9w0BAQUFAAOCAQEAE1mwJUFj1qLS24EO081TEezh+MYMB4KIAqTpQC2xSH0LWAHirHgUjnLwKmRAsiXDvA+WdTNVDTeP4T54GH67B7TLW0vn/Gp4ISGrAzMUcSmKoAzGtJVXWBK7U/x0Jle/vAai/HcHPIwxc7M68hxPFk5CebxTEU233XZN2kFGrwbo7so/SHnO+Uy0EjQVbSuzDf+vGIbVyRCLULcp+2ZFj/NN54Zoz/9FsMLYI5AXlv37jEvI5CMjSsmQvLEwGJMkiUcI0YNfoduDZ/21EzEKHtUC54L3QRLBEsFdQ1MlrwAJLfgoq813n8DkufKRjn1hvbdDLPWhOqO77RP0vOfVrA==</ds:X509Certificate>
</ds:X509Data>
</ds:KeyInfo>
</ds:Signature>
</saml:Assertion>
</samlp:Response>
Anyone know where is the problem? Or could anybody give me a correct saml response so that I can make sure my code is written in right way?
Thanks.
----------
Best Regards,
Li Run
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/dev/attachments/20121204/f0d1d114/attachment-0001.html
More information about the dev
mailing list