Exception when validating the signature of the assertion

[Brent Putman]

On 11/6/12 6:03 PM, Yaowen Tu wrote:
> Thanks for you answers Brent and Scott.
>
> Can I dig one more step further? I don't really understand how step c
> is done. 

The actual details are very complicated.  For that you need to read the
W3C XML Signature specification.  But I doubt you really need to
understand it at that level if you're just trying to sign and validate
SAML messages.  The point of OpenSAML is to abstract all that away and
hide the details.


> To me in order to finish step c, we need the string of the whole
> assertion, otherwise we won't be able to construct the digest value.
> Is the string part of the Signature object stored in some private
> field? Can you point out which field? or which part of the code do this?

You yourself don't need to do anything, it's handled for you.  That's
actually the whole point the SignatureValidator.

The actual technical answer is that the input that is signed/validated
is the canonicalized octet stream of the resources identified by the
Reference element(s) of the signature.  Read the spec if you really need
to know all the gory details.