Exception when validating the signature of the assertion

[Yaowen Tu]

Scott maybe I should have asked it in another way:

When SP tries to validate the signature, theoretically it needs to:
        a. make sure the certificate of IdP really belongs to the IdP. This
is done by trust engine.
        b. make sure the signature is generated by the private key of the
certificate by decrypting it using the public key in the certificate
        c. make sure the message is not modified by comparing the digest
value of the assertion and decrypted signature.

I know the method doesn't do step a, but how about step b and c? I think
the method will do step b, since it accepts signature and credential as the
parameters. What I really want to know if how step c is achieved?

Yaowen


On Tue, Nov 6, 2012 at 2:37 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:

> On 11/6/12 5:28 PM, "Yaowen Tu" <yaowen.tu at gmail.com> wrote:
> >
> >3. When SP tries to validate the signature, theoretically it needs to:
> >          a. make sure the signature is generated by the private key of
> >the IdP
> >          b. make sure the message is not modified by comparing the
> >digest value of the assertion and decrypted signature.
> >
> >The method validateSignature(Signature signature, Credential
> >validatingCredential) seems to only do the step (a), could you please
> >tell me where and how we do step (b)? Maybe the Signature object contains
> >some extra information than I imagined?
>
> That method does b, not a. a is the job of a trust engine.
>
> -- Scott
>
>
> --
> To unsubscribe from this list send an email to
> dev-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/dev/attachments/20121106/3013cb5c/attachment-0001.html