Missing InclusiveNamespaces in the AuthnRequest

[Asaf Peter]

Hi Shibboleth Developers,

I am implementing an SP initiated web browser SAML 2.0 SSO profile in JBOSS.

I am testing it with a Shibboleth IDP.

I have managed to get a full authentication workflow with the SAML IDP using opensaml, when sending an unsigned AuthenRequest.

Now I am trying to add a signature to the AuthenRequest, but getting an error - Error decoding authentication request message.

In the idp-process.log I see that there is an org.opensaml.xml.parse.XMLParserException: Invalid XML error.

It seems that the ec:InclusiveNamespaces tag is missing from the signature.

Here's the Transforms part created by me:

<ds:Transforms>
      <ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" />
         <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
   </ds:Transforms>

And here's an example from the valid SAMLResponse coming back from the IDP:

  <ds:Transforms>
          <ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" />
<ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#">
<ec:InclusiveNamespaces xmlns:ec="http://www.w3.org/2001/10/xml-exc-c14n#" PrefixList="ds saml samlp xenc" />
            </ds:Transform>
    </ds:Transforms>

When adding the tag manually the authentication works fine.
Am I missing something in the creation of the Signature?
Is there a way to set this tag?

Here's the code I use:

           Signature signature = (Signature) Configuration.getBuilderFactory()
                    .getBuilder(Signature.DEFAULT_ELEMENT_NAME).buildObject(Signature.DEFAULT_ELEMENT_NAME);
            KeyStore keyStore = getKS();
            RSAPrivateKey privateKey = (RSAPrivateKey) keyStore.getKey(JKS_ALIAS,
                    PWD.toCharArray());
            BasicX509Credential decryptionCredential = new BasicX509Credential();
            decryptionCredential.setPrivateKey(privateKey);
            signature.setSigningCredential(decryptionCredential);
            signature.setSignatureAlgorithm(SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA1);
            signature.setCanonicalizationAlgorithm(SignatureConstants.ALGO_ID_C14N_EXCL_OMIT_COMMENTS);
            KeyInfo keyinfo = (KeyInfo) Configuration.getBuilderFactory().getBuilder(KeyInfo.DEFAULT_ELEMENT_NAME)
                    .buildObject(KeyInfo.DEFAULT_ELEMENT_NAME);
            X509Certificate certificate = (X509Certificate) keyStore.getCertificate(JKS_ALIAS);
            KeyInfoHelper.addCertificate(keyinfo, certificate);
            signature.setKeyInfo(keyinfo);
            SecurityConfiguration secConfig = Configuration.getGlobalSecurityConfiguration();
            String keyInfoGeneratorProfile = "XMLSignature";

            try {
                SecurityHelper.prepareSignatureParams(signature, decryptionCredential, secConfig,
                        keyInfoGeneratorProfile);
            } catch (SecurityException e) {
                e.printStackTrace();
            }

       ...

            authnRequest.setSignature(signature);

            Marshaller marshaller = Configuration.getMarshallerFactory().getMarshaller(authnRequest);
            Element authDOM = null;
            try {
                authDOM = marshaller.marshall(authnRequest);
            } catch (MarshallingException e) {
                e.printStackTrace();
            }

            try {
                Signer.signObject(signature);
            } catch (SignatureException e) {
                e.printStackTrace();
            }




Thanks,
Asaf


-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/dev/attachments/20130121/ae9d008b/attachment-0001.html