Signature verification failed

[Brent Putman]

On 12/3/12 8:57 PM, Li Run wrote:
>
> Hi, all
>
>  
>
> I'm using OpenSAML to test some SAML1.1 sso. When I get a saml
> response from the server, I try to validate the signature of the saml
> assertion, but I always get the "Signature verification failed" error.
>
>  
>
> My code is like:
>
>  
>
>

Assuming that the correct signing/validation key is included in the
Signature's KeyInfo, this code should work as far as the mechanical
cryptographic validation of the signature.  (Note that it is critical to
also establish trust of the key - you can not just trust the key
supplied in the message.  But that is not related to your problem.)


>  
>
>  
>
> Anyone know where is the problem? Or could anybody give me a correct
> saml response so that I can make sure my code is written in right way?
>


See this page on signature troubleshooting.

https://wiki.shibboleth.net/confluence/display/OpenSAML/OSTwoUserManSigErrors


Assuming that the key is correct, the problem is most likely that the
signed document is being changed sometime between when it is signed by
the sender and when you validate it. Likely culprits are pretty-print
formatting the XML or other mutations of the DOM after it is parsed.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/dev/attachments/20121204/ac796031/attachment.html