Signature verification failed

[Li Run]

Thanks for your reply.

I'm not sure the key in the keyinfo is correct or not.
Can you send me some examples of signed assertions with correct key info? Thanks.

From: dev-bounces at shibboleth.net [mailto:dev-bounces at shibboleth.net] On Behalf Of Brent Putman
Sent: Tuesday, December 04, 2012 11:25 PM
To: dev at shibboleth.net
Subject: Re: Signature verification failed


On 12/3/12 8:57 PM, Li Run wrote:
Hi, all

I'm using OpenSAML to test some SAML1.1 sso. When I get a saml response from the server, I try to validate the signature of the saml assertion, but I always get the "Signature verification failed" error.

My code is like:



Assuming that the correct signing/validation key is included in the Signature's KeyInfo, this code should work as far as the mechanical cryptographic validation of the signature.  (Note that it is critical to also establish trust of the key - you can not just trust the key supplied in the message.  But that is not related to your problem.)





Anyone know where is the problem? Or could anybody give me a correct saml response so that I can make sure my code is written in right way?


See this page on signature troubleshooting.

https://wiki.shibboleth.net/confluence/display/OpenSAML/OSTwoUserManSigErrors


Assuming that the key is correct, the problem is most likely that the signed document is being changed sometime between when it is signed by the sender and when you validate it. Likely culprits are pretty-print formatting the XML or other mutations of the DOM after it is parsed.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/dev/attachments/20121205/f06a9472/attachment.html