Exception when creating the signature using OpenSAML lib

[Brent Putman]

On 10/31/12 7:53 PM, Yaowen Tu wrote:
> What I am passing into the valida() is a Signature, and there is only
> one signature under SPSSODescriptor, so that cannot be wrong, is it?

As long as you are consistently signing and validating the same
signature object, that is correct.

Another thought is:  If you're writing a unit test, etc, it's best if
you at least marshall the XML to DOM and then unmarshall a new XMLObject
tree around it, and then validate the signature on the new tree. Of
course you can also fully serialize it out and the deserialize and
unmarshall.  It used to be the case that Santuario (low level Apache XML
Signature library) wouldn't even work if you signed and then immediately
validated the same XMLSignature instance.  I don't know if that's still
a problem, and you aren't even getting that far yet, but it's possible
that whatever you are doing is triggering a similar issue at the
OpenSAML layer.  In general signing and then immediately validating the
same Signature instance isn't a real world use case - only for
artificial cases like tests and such - and so I don't know for a fact
that that would even work in OpenSAML.  That's the only other thing I
can think of off-hand which might cause the (weird) issue you are seeing.


>
> Another question, can you take a look at the metadata that I just sent
> again? The structure is like:
>
> <md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
> entityID="www.localhost.com <http://www.localhost.com>">
>     <md:SPSSODescriptor AuthnRequestsSigned="false"
> WantAssertionsSigned="false" errorURL="www.localhost.com/SAML/ERROR
> <http://www.localhost.com/SAML/ERROR>" 


This is totally unrelated to your problem, but the SAML spec mandates
the use of absolute URI's pretty much everywhere, so you really should
have the http or https scheme on those.  OpenSAML won't care, but other
code consuming the SAML that you generate might.


>
>
> There are two <KeyInfo>, I am using the same public key and private
> key to generate it, so does is matter to use which one to verify the
> signature? I think no, but I just want to rule out this case.


It really depends on what you are trying to achieve.  If you really mean
to sign the metadata with the entity's own key, then what you say is
correct, but that has implications for the trust model you use with
whomever consumes your metadata.  To be technically precise, the
Signature/KeyInfo is the one that is the hint as to the signing key
(here for the metadata signature).  The KeyDescriptor/KeyInfo is the
entity's own key that it uses for SAML purposes, and in the real world
is very often not the metadata signing key.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/dev/attachments/20121031/6954c36d/attachment.html