error validating signature on Jboss

[Mitu Singh]

Brent, Paul,

I found the source of the issue. Jboss7.1.1 has modules for xmlsec version 1.5.4. The xmlsec that works with opensaml is 1.4.5. If I replace the xmlsec module in the jboss with 1.4.5, everything works fine. 

I see the same error if I put the latest version of xmlsec, i.e 1.5.4 on tomcat.


So it is not the version of xerces but the version of xmlsec. 


Has anyone else seen this issue with opensaml and xmlsec latest version?

Thanks
-Mitu



________________________________
 From: Brent Putman <putmanb at georgetown.edu>
To: dev at shibboleth.net 
Sent: Friday, May 10, 2013 1:40 PM
Subject: Re: error validating signature on Jboss
 




On 5/9/13 1:56 PM, Mitu Singh wrote:

Hello,
>
>
>I am implementing Service Provider using opensaml. The Service Provider works very well when deployed on tomcat. But when I deploy it on Jboss, I get the following error while validating signature:
>ERROR [org.opensaml.security.SAMLSignatureProfileValidator] Apache xmlsec IdResolver could not resolve the Element for id reference:
What that error literally means is that it can't find the DOM
    Element pointed to by the signature's Reference URI.  It basically
    uses Document#getElementById(id), where id is the value from the
    Reference URI attribute, without the leading '#'.  



>
>I am using Jboss7.1.1.Final. Has anybody else seen this issue? How can I fix this.
>
>
As Paul mentioned, it's likely that it's not JBoss vs Tomcat per se,
    but rather a difference in the XML parsing environments, perhaps
    related to differing versions of endorsed libraries.  Although I
    wouldn't think that not endorsing would cause this problem, unless
    JBoss is using a really old and/or broken version of Xerces.

I suppose you should also verify the obvious: that the signed thing
    (e.g. Assertion or Response) has a valid ID attribute with a
    non-empty value, and that the Reference URI validly refers to that
    same ID value.

--Brent



--
To unsubscribe from this list send an email to dev-unsubscribe at shibboleth.net
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/dev/attachments/20130510/17c59146/attachment-0001.html