Missing InclusiveNamespaces in the AuthnRequest

[Asaf Peter]

Hi Brent,

I have tried the 2 approaches - with or without the SecurityHelper, but still gets the same problem.
Attached the XML created by me. Can you find something from it?

Thanks,
Asaf

From: dev-bounces at shibboleth.net [mailto:dev-bounces at shibboleth.net] On Behalf Of Brent Putman
Sent: Wednesday, January 23, 2013 00:03
To: dev at shibboleth.net
Subject: Re: Missing InclusiveNamespaces in the AuthnRequest


On 1/21/13 10:27 AM, Asaf Peter wrote:
Hi Shibboleth Developers,

I am implementing an SP initiated web browser SAML 2.0 SSO profile in JBOSS.

I am testing it with a Shibboleth IDP.

I have managed to get a full authentication workflow with the SAML IDP using opensaml, when sending an unsigned AuthenRequest.

Now I am trying to add a signature to the AuthenRequest, but getting an error - Error decoding authentication request message.

In the idp-process.log I see that there is an org.opensaml.xml.parse.XMLParserException: Invalid XML error.

Are there any details?  I thought Xerces usually gave some info about what the unparseable XML was.

You can also use an external tool to manually decode the request param from your browser to a string, like SAML Tracer plugin to Firefox and this website:

https://rnd.feide.no/software/saml_2_0_debugger/

This will let you visually inspect the XML and see if you can spot the issue.

You also might be sending to a wrong endpoint on the IdP or something like that.




It seems that the ec:InclusiveNamespaces tag is missing from the signature.

Here's the Transforms part created by me:

<ds:Transforms>
      <ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" />
         <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#<http://www.w3.org/2001/10/xml-exc-c14n>" />
   </ds:Transforms>

And here's an example from the valid SAMLResponse coming back from the IDP:

  <ds:Transforms>
          <ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" />
<ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#<http://www.w3.org/2001/10/xml-exc-c14n>">
<ec:InclusiveNamespaces xmlns:ec="http://www.w3.org/2001/10/xml-exc-c14n#<http://www.w3.org/2001/10/xml-exc-c14n>" PrefixList="ds saml samlp xenc" />
            </ds:Transform>
    </ds:Transforms>

That is suspicious in itself, I think the OpenSAML code should be emitting the inclusive namespaces list (unless you are using a really old version of OpenSAML).

But as Scott said, that's not going to result in the error you are seeing.




When adding the tag manually the authentication works fine.
Am I missing something in the creation of the Signature?
Is there a way to set this tag?

Here's the code I use:

           Signature signature = (Signature) Configuration.getBuilderFactory()
                    .getBuilder(Signature.DEFAULT_ELEMENT_NAME).buildObject(Signature.DEFAULT_ELEMENT_NAME);
            KeyStore keyStore = getKS();
            RSAPrivateKey privateKey = (RSAPrivateKey) keyStore.getKey(JKS_ALIAS,
                    PWD.toCharArray());
            BasicX509Credential decryptionCredential = new BasicX509Credential();
            decryptionCredential.setPrivateKey(privateKey);
            signature.setSigningCredential(decryptionCredential);
            signature.setSignatureAlgorithm(SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA1);
            signature.setCanonicalizationAlgorithm(SignatureConstants.ALGO_ID_C14N_EXCL_OMIT_COMMENTS);
            KeyInfo keyinfo = (KeyInfo) Configuration.getBuilderFactory().getBuilder(KeyInfo.DEFAULT_ELEMENT_NAME)
                    .buildObject(KeyInfo.DEFAULT_ELEMENT_NAME);
            X509Certificate certificate = (X509Certificate) keyStore.getCertificate(JKS_ALIAS);
            KeyInfoHelper.addCertificate(keyinfo, certificate);
            signature.setKeyInfo(keyinfo);
            SecurityConfiguration secConfig = Configuration.getGlobalSecurityConfiguration();
            String keyInfoGeneratorProfile = "XMLSignature";

            try {
                SecurityHelper.prepareSignatureParams(signature, decryptionCredential, secConfig,
                        keyInfoGeneratorProfile);
            } catch (SecurityException e) {
                e.printStackTrace();
            }



I don't know whether this affects your problem - probably not - but you are duplicating code here.  The whole point of the SecurityHelper.prepareSignatureParams is a helper to set a bunch of the stuff that you are setting explicitly above.  So just pick one or the other approaches, but not both.  The examples of use of the 2 cases are here:

https://wiki.shibboleth.net/confluence/display/OpenSAML/OSTwoUserManJavaDSIG

Also, by default there is no KeyInfoGenerator named "XMLSignature", in fact there aren't any named ones at all.  If you just pass null, it will use the default one.

--Brent



-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/dev/attachments/20130123/2e5d615b/attachment-0001.html 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: authenRequestExample.xml
Type: text/xml
Size: 3510 bytes
Desc: authenRequestExample.xml
Url : http://shibboleth.net/pipermail/dev/attachments/20130123/2e5d615b/attachment-0001.xml