Exception when validating the signature of the assertion

[Cantor, Scott]

On 11/6/12 5:47 PM, "Yaowen Tu" <yaowen.tu at gmail.com> wrote:
>Scott maybe I should have asked it in another way:
>
>When SP tries to validate the signature, theoretically it needs to:
>        a. make sure the certificate of IdP really belongs to the IdP.
>This is done by trust engine.

No. That's one example of a trust engine. The more common one does not do
that, but simply determines if a public key is trusted for that issuer.

>        b. make sure the signature is generated by the private key of the
>certificate by decrypting it using the public key in the certificate
>        c. make sure the message is not modified by comparing the digest
>value of the assertion and decrypted signature.

Both b and c are what the signature and sig profile validators do, because
they start by needing to know what key pair was used to create the
signature and then check the signature against that key pair.

The last step is to determine if that keypair is acceptable for that
issuer. Nowhere does "certificate" figure in any of this until the last
step.

>I know the method doesn't do step a, but how about step b and c? I think
>the method will do step b, since it accepts signature and credential as
>the parameters. What I really want to know if how step c is achieved?

That's what the SignatureValidator does, it's part of verifying an XML
signature. The profile validator verifies that the signature is actually
covering the necessary data. After that, it's up to the trust layer.

-- Scott