Exception when validating the signature of the assertion

[Brent Putman]

On 11/6/12 2:30 PM, Yaowen Tu wrote:
> Hi,
>
> When I try to validate the signature of a decrypted assertion, I got
> the following exception:
>
> Caused by: org.opensaml.xml.validation.ValidationException: Apache
> xmlsec IdResolver could not resolve the Element for id reference:
> _83f4c0d593d29a106d35d59acc15da2b
>     at
> org.opensaml.security.SAMLSignatureProfileValidator.validateReferenceURI(SAMLSignatureProfileValidator.java:153)
>     at
> org.opensaml.security.SAMLSignatureProfileValidator.validateSignatureImpl(SAMLSignatureProfileValidator.java:84)
>     at
> org.opensaml.security.SAMLSignatureProfileValidator.validate(SAMLSignatureProfileValidator.java:56)
>


This is basically the issue that is highlighted in the big red warning
box directly underneath this spot in the wiki:

https://wiki.shibboleth.net/confluence/display/OpenSAML/OSTwoUserManJavaXMLEncryption#OSTwoUserManJavaXMLEncryption-CreateaSAML2Decrypter

For the details, please see the Javadocs as noted there.



> My code is:
>             //The getAssertion method will decrypt the assertion from
> the response
>             Assertion assertion = getAssertion( response );
>
>             if( assertion.isSigned() )
>             {
>                 // Now we must validate the signature of the assertion
>                 Signature signatureToValidate = assertion.getSignature();
>                 // Now try to validate. Throw exception if not valid.
>                 super.validateSignature( signatureToValidate,
> validatingCredential);
>             }
>
> public void validateSignature(Signature signature, Credential
> validatingCredential) throws ValidationException
>     {
>         SAMLSignatureProfileValidator profileValidator = new
> SAMLSignatureProfileValidator();
>         profileValidator.validate( signature );
>        
>         SignatureValidator signatureValidator = new
> SignatureValidator( validatingCredential );
>         signatureValidator.validate( signature );
>     }
>


That looks fine, at least as far as mechanically validating the
signature (still need to establish trust of the validation key, but
perhaps you are doing that elsewhere). The issue isn't with how you're
validating the signature, but rather with how it is being decrypted and
some things that happen at the DOM level.  The info I reference above
above should explain why.