Missing InclusiveNamespaces in the AuthnRequest

[Brent Putman]

On 1/21/13 10:27 AM, Asaf Peter wrote:
>
> Hi Shibboleth Developers,
>
>  
>
> I am implementing an SP initiated web browser SAML 2.0 SSO profile in
> JBOSS.
>
>  
>
> I am testing it with a Shibboleth IDP.
>
>
> I have managed to get a full authentication workflow with the SAML IDP
> using opensaml, when sending an unsigned AuthenRequest.
>
>  
>
> Now I am trying to add a signature to the AuthenRequest, but getting
> an error - *Error decoding authentication request message.*
>
> * *
>
> In the idp-process.log I see that there is an
> org.opensaml.xml.parse.XMLParserException: Invalid XML error.
>

Are there any details?  I thought Xerces usually gave some info about
what the unparseable XML was.

You can also use an external tool to manually decode the request param
from your browser to a string, like SAML Tracer plugin to Firefox and
this website:

https://rnd.feide.no/software/saml_2_0_debugger/

This will let you visually inspect the XML and see if you can spot the
issue.

You also might be sending to a wrong endpoint on the IdP or something
like that.


>  
>
> It seems that the ec:InclusiveNamespaces tag is missing from the
> signature.
>
> *   *
>
> Here's the Transforms part created by me:
>
>  
>
> **<ds:Transforms>
>
>       <ds:Transform
> Algorithm="*http://www.w3.org/2000/09/xmldsig#enveloped-signature*" />
>
>         <ds:Transform
> Algorithm="*http://www.w3.org/2001/10/xml-exc-c14n#*" />
>
>   </ds:Transforms>
>
>  
>
> And here's an example from the valid SAMLResponse coming back from the
> IDP:
>
>  
>
> *  *<ds:Transforms>
>
>          <ds:Transform
> Algorithm="*http://www.w3.org/2000/09/xmldsig#enveloped-signature*" />
>
> <ds:Transform Algorithm="*http://www.w3.org/2001/10/xml-exc-c14n#*">
>
> <ec:InclusiveNamespacesxmlns:ec="*http://www.w3.org/2001/10/xml-exc-c14n#*"PrefixList="*ds
> saml samlp xenc*" />
>
>            </ds:Transform>
>
>    </ds:Transforms>
>

That is suspicious in itself, I think the OpenSAML code should be
emitting the inclusive namespaces list (unless you are using a really
old version of OpenSAML).

But as Scott said, that's not going to result in the error you are seeing.


>  
>
> When adding the tag manually the authentication works fine.
>
> Am I missing something in the creation of the Signature?
>
> Is there a way to set this tag?
>
>  
>
> Here's the code I use:
>
>  
>
>            Signature signature = (Signature)
> Configuration./getBuilderFactory/()
>
>                    
> .getBuilder(Signature./DEFAULT_ELEMENT_NAME/).buildObject(Signature./DEFAULT_ELEMENT_NAME/);
>
>             KeyStore keyStore = getKS();
>
>             RSAPrivateKey privateKey = (RSAPrivateKey)
> keyStore.getKey(/JKS_ALIAS/,
>
>                     /PWD/.toCharArray());
>
>             BasicX509Credential decryptionCredential =
> *new*BasicX509Credential();
>
>             decryptionCredential.setPrivateKey(privateKey);
>
>             signature.setSigningCredential(decryptionCredential);
>
>            
> signature.setSignatureAlgorithm(SignatureConstants./ALGO_ID_SIGNATURE_RSA_SHA1/);
>
>            
> signature.setCanonicalizationAlgorithm(SignatureConstants./ALGO_ID_C14N_EXCL_OMIT_COMMENTS/);
>
>             KeyInfo keyinfo = (KeyInfo)
> Configuration./getBuilderFactory/().getBuilder(KeyInfo./DEFAULT_ELEMENT_NAME/)
>
>                     .buildObject(KeyInfo./DEFAULT_ELEMENT_NAME/);
>
>             X509Certificate certificate = (X509Certificate)
> keyStore.getCertificate(/JKS_ALIAS/);
>
>             KeyInfoHelper./addCertificate/(keyinfo, certificate);
>
>             signature.setKeyInfo(keyinfo);
>
>             SecurityConfiguration secConfig =
> Configuration./getGlobalSecurityConfiguration/();
>
>             String keyInfoGeneratorProfile = "XMLSignature";
>
>  
>
>             *try*{
>
>                 SecurityHelper./prepareSignatureParams/(signature,
> decryptionCredential, secConfig,
>
>                         keyInfoGeneratorProfile);
>
>             } *catch*(SecurityException e) {
>
>                 e.printStackTrace();
>
>             }
>
>  
>


I don't know whether this affects your problem - probably not - but you
are duplicating code here.  The whole point of the
SecurityHelper.prepareSignatureParams is a helper to set a bunch of the
stuff that you are setting explicitly above.  So just pick one or the
other approaches, but not both.  The examples of use of the 2 cases are
here:

https://wiki.shibboleth.net/confluence/display/OpenSAML/OSTwoUserManJavaDSIG

Also, by default there is no KeyInfoGenerator named "XMLSignature", in
fact there aren't any named ones at all.  If you just pass null, it will
use the default one.

--Brent



-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/dev/attachments/20130122/3b2a4f34/attachment-0001.html