Metadata Aggregator - Issues with XMLSignatureSigningStage

[Dan McLaughlin]

The new version of the MDA seemed to work fine, then today I actually
tried to get our SP to consume the metadata it aggregated and signed,
but every time I enabled the Signature MetadataFilter to validate the
signature I would get an error telling me "CRIT Shibboleth.Application
: error initializing MetadataProvider: SignatureMetadataFilter unable
to verify signature at root of metadata instance."

I assumed maybe my private/public key pair I was using to sign and
validate the metadata was bad, so I used openssl to verify that the
private key I used with the MDA to sign the metadata matched the
public key I was using in the SP to validate the signature.  Long
story short, openssl confirmed they matched.

Then I used xmlsectool to validate the signature on the metadata
generated by MDA and it complained as well, but gave me a little more
detail.

xmlsectool.sh --verifySignature --certificate
./certs/my-signing-cert.pem --inFile
/tmp/mda/federation/my-federation-metadata.xml
INFO  XmlSecTool - Reading XML document from file
'/tmp/mda/federation/my-federation-metadata.xml'
INFO  XmlSecTool - XML document parsed and is well-formed.
ERROR XmlSecTool - Unknown error
java.lang.StringIndexOutOfBoundsException: String index out of range: -1
at java.lang.String.substring(String.java:1937) ~[na:1.6.0_29]
at java.lang.String.substring(String.java:1904) ~[na:1.6.0_29]
at edu.internet2.middleware.security.XmlSecTool.validateSignatureReferenceUri(XmlSecTool.java:623)
~[xmlsectool-1.1.5.jar:na]
at edu.internet2.middleware.security.XmlSecTool.validateSignatureReference(XmlSecTool.java:602)
~[xmlsectool-1.1.5.jar:na]
at edu.internet2.middleware.security.XmlSecTool.verifySignature(XmlSecTool.java:554)
~[xmlsectool-1.1.5.jar:na]
at edu.internet2.middleware.security.XmlSecTool.main(XmlSecTool.java:156)
~[xmlsectool-1.1.5.jar:na]

Which led me to
https://issues.shibboleth.net/jira/browse/XSTJ-15?page=com.atlassian.jira.plugin.system.issuetabpanels%3Acomment-tabpanel#issue-tabs

Then I decided to add an XMLSignatureValidationStage to my MDA
configuration to validate the signature after the MDA signed it, and I
got the following error:

mda.sh /tmp/mda/my-federation-config.xml validateSignature
2012-01-23 19:39:46,391 - WARN
[org.apache.xml.security.signature.Reference:-1] - Verification failed
for URI ""
2012-01-23 19:39:46,394 - WARN
[org.apache.xml.security.signature.Reference:-1] - Expected Digest:
I0I+qxu89yE2c6grAFkgO+IbgaEv9DIhCYiGe+JDA/Q=
2012-01-23 19:39:46,395 - WARN
[org.apache.xml.security.signature.Reference:-1] - Actual Digest:
usLmjOJIFNbagPGDEVXW0C0fhwLEtZ8jt0FWWx0/VIA=

As I test I manually added an ID (ID=MYM20120123T194212) to the
EntitiesDescriptor that the MDA created using the
EntitiesDescriptorAssemblerStage, then I used xmlsectool to sign the
metadata using --referenceIdAttributeName ID.  Now I had no issues
validating the signature.

./xmlsectool.sh --sign --referenceIdAttributeName ID --inFile
/tmp/mda/federation/my-federation-metadata-unsigned.xml --key
../certs/my-signing-key.pem --certificate ../certs/my-signing-cert.pem
--outFile /tmp/mda/federation/my-federation-metadata.xml
INFO  XmlSecTool - Reading XML document from file
'/tmp/mda/federation/my-federation-metadata-unsigned.xml'
INFO  XmlSecTool - XML document parsed and is well-formed.
INFO  XmlSecTool - XML document successfully signed
INFO  XmlSecTool - XML document written to file
/tmp/mda/federation/my-federation-metadata.xml

./xmlsectool.sh --verifySignature --signatureRequired --certificate
../certs/my-signing-cert.pem --inFile
/tmp/mda/federation/my-federation-metadata.xml
INFO  XmlSecTool - Reading XML document from file
'/tmp/mda/federation/my-federation-metadata.xml'
INFO  XmlSecTool - XML document parsed and is well-formed.
INFO  XmlSecTool - XML document signature verified.

I think I'm on the right track...

The signature that the MDA is adding isn't valid because the Reference
URI for the Signature isn't getting set by my
XMLSignatureSigningStage, the reason the Reference URI isn't getting
set is because the EntitiesDescriptorAssemblerStage doesn't set the ID
for the EntitiesDescriptor, the reason the ID isn't getting set for
the EntitiesDescriptor is because I don't have a
EntityDescriptorItemIdPopulationStage, and the reason I don't have an
EntityDescriptorItemIdPopulationStage is because I used the examples
to build my MDA configuration (which also don't use an
EntityDescriptorItemIdPopulationStage), so I never realized until
after several hours of debugging today that it was even necessary.

Now for the difficult question...Does anyone have an example that
shows how to properly define an EntityDescriptorItemIdPopulationStage
so I can get an ID assigned to my EntitiesDescriptor?