Exception when creating the signature using OpenSAML lib

[Yaowen Tu]

1. I am not signing and validating the same instance. I write the whole
metadata to a file, then in step 2, I load it and validate it. So I don't
think I am hinting the same issue.

2. Even if I just load a testing metadata file, for example
openid-metadata.xml, which you are using in the unit test as well. I still
see the same error. So maybe my code to validate the signature is wrong?
Here is my code, which is pretty much same as wiki:
    public void validateSignature(Signature signature, Credential
validatingCredential) throws ValidationException
    {
        SAMLSignatureProfileValidator profileValidator = new
SAMLSignatureProfileValidator();
        profileValidator.validate( signature );

        SignatureValidator signatureValidator = new SignatureValidator(
validatingCredential );
        // Now try to validate. Throw exception if not valid.
        signatureValidator.validate( signature );
    }
    For testing, validatingCredential is the one I get under the
<Signature><KeyInfo> tag. Can you see any problems? Or do you have any
simple working example that I can look at?

3. Regarding this sentence: " The KeyDescriptor/KeyInfo is the entity's own
key that it uses for SAML purposes, and in the real world is very often not
the metadata signing key." We are currently in the process of developing a
Single Sign On product, can you please tell me more about why these two
keys are very often no the same?

4. Thanks for you information about TrustEngine. I will look into it and if
possible implement it in our product.

On Wed, Oct 31, 2012 at 5:54 PM, Brent Putman <putmanb at georgetown.edu>wrote:

>
> On 10/31/12 8:40 PM, Yaowen Tu wrote:
> > Another related question is: how to retrieve the credential under
> > <Signature>?
>
> You use a KeyInfoCredentialResolver to resolve Credentials from a
> ds:KeyInfo element.  I don't know if that's documented in the wiki, but
> I'm sure there are some unit tests you can use as an example.
>
> In general, though, be careful that the Signature/KeyInfo is only a
> hint, you can not trust that key.  You have to validate that the key is
> trusted, one way or another (either from a set of trusted keys or via
> X.509 PKIX, etc).
>
> We also have a higher-level of abstraction called TrustEngine, which
> wraps up the signature verification and trust processing in a single
> component.
>
>
>
> --
> To unsubscribe from this list send an email to
> dev-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/dev/attachments/20121031/64888076/attachment-0001.html