Exception when validating the signature of the assertion

[Brent Putman]

On 11/6/12 5:47 PM, Yaowen Tu wrote:
> Scott maybe I should have asked it in another way:
>
> When SP tries to validate the signature, theoretically it needs to:
>         a. make sure the certificate of IdP really belongs to the IdP.
> This is done by trust engine.

Yes, by either our TrustEngine/SignaureTrustEngine, or a some other code
that performs the same function.


>         b. make sure the signature is generated by the private key of
> the certificate by decrypting it using the public key in the certificate
>         c. make sure the message is not modified by comparing the
> digest value of the assertion and decrypted signature.


b and c are both part of what I could call cryptographic operation of
XML Signature verification, they aren't really separate steps, at least
from a high-level.  If you were implmenting a low-level XML Signature
library, then yes, these would be separate steps in the process.




>
> I know the method doesn't do step a, but how about step b and c? I
> think the method will do step b, since it accepts signature and
> credential as the parameters. What I really want to know if how step c
> is achieved?

Both b and c are handled by the OpenSAML SignatureValidator via the
underlying signature library we use (Apache Santuario/xmlsec), so you
don't have to do anything there.  If the Signature validates with the
Credential you pass in, then both b and c have been evaluated successfully.