error validating signature on Jboss

[Brent Putman]

On 5/9/13 1:56 PM, Mitu Singh wrote:
> Hello,
>
> I am implementing Service Provider using opensaml. The Service Provider works very well when
> deployed on tomcat. But when I deploy it on Jboss, I get the following error while validating
> signature:
> ERROR [org.opensaml.security.SAMLSignatureProfileValidator] Apache xmlsec IdResolver could not
> resolve the Element for id reference:

What that error literally means is that it can't find the DOM Element pointed to by the signature's
Reference URI.  It basically uses Document#getElementById(id), where id is the value from the
Reference URI attribute, without the leading '#'. 

>
> I am using Jboss7.1.1.Final. Has anybody else seen this issue? How can I fix this.
>

As Paul mentioned, it's likely that it's not JBoss vs Tomcat per se, but rather a difference in the
XML parsing environments, perhaps related to differing versions of endorsed libraries.  Although I
wouldn't think that not endorsing would cause this problem, unless JBoss is using a really old
and/or broken version of Xerces.

I suppose you should also verify the obvious: that the signed thing (e.g. Assertion or Response) has
a valid ID attribute with a non-empty value, and that the Reference URI validly refers to that same
ID value.

--Brent


-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/dev/attachments/20130510/7dc877e1/attachment.html