error validating signature on Jboss

[Mitu Singh]

Brent,

I am using opensaml2.5.3. I see the same error when I use opensaml 2.6.0

I am using xercesImpl-2.10.0, xalan-2.7.1

I checked that the reference URI has the id of the response (although it does have a '#' before it)

The SAML Response: 
<?xml version="1.0" encoding="UTF-8"?>
<saml2p:Response xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol" Destination="https://localhost:8443/SamlSP/ACS" 
ID="_3c0dece1a0427717acb353977f3c3b3c" IssueInstant="2013-05-13T19:16:26.203Z" Version="2.0" xmlns:xs="http://www.w3.org/2001/XMLSchema">

<saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">SP</saml2:Issuer>

<ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
    <ds:SignedInfo>
    <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
    <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
    <ds:Reference URI="#_3c0dece1a0427717acb353977f3c3b3c">
    <ds:Transforms>
    <ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
    <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"><ec:InclusiveNamespaces xmlns:ec="http://www.w3.org/2001/10/xml-exc-c14n#" PrefixList="xs"/></ds:Transform>
    </ds:Transforms>
    <ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/><ds:DigestValue>Qzow2pLKwlsBBn0ewQt3m2ETvuw=</ds:DigestValue></ds:Reference>
    </ds:SignedInfo>

    <ds:SignatureValue>M4qnr3eVW3CIfpGPiV5jsmdy0kVfbOWuHEzHWD1jSysC2HgmTNqOraJGUUE2Y59I2yZOF1U7E7Ubo89yaZVXd/k4RLKVAHV/WpOthdVVDIW61N3qS//Y8HFEHahwpXnxNVGhMZgzfJmtQt0QW2DRNh2D+oRW/N2ECj7XfMABUQQ=
    </ds:SignatureValue>
    
    <ds:KeyInfo>
    <ds:X509Data>
    <ds:X509Certificate>MIICBjCCAW8CBgE+hflknjANBgkqhkiG9w0BAQsFADBJMSYwJAYDVQQLEx1Ub3R2c0xhYnMgUHJp
bWFyeSBDZXJ0aWZpY2F0ZTESMBAGA1UEChMJVG90dnNMYWJzMQswCQYDVQQGEwJVUzAeFw0xMzA1
MDgyMTA4MzRaFw0xMzA1MDkxMTAyNTlaMEkxJjAkBgNVBAsTHVRvdHZzTGFicyBQcmltYXJ5IENl
cnRpZmljYXRlMRIwEAYDVQQKEwlUb3R2c0xhYnMxCzAJBgNVBAYTAlVTMIGfMA0GCSqGSIb3DQEB
AQUAA4GNADCBiQKBgQCcx7YdEFnTpzhrY/yAAWR5HkDxYqXaLID1GaEZWJht90Lk3uIr8qJVwIso
Ee3RpZ8DNVm3688R9sqgHflMqzzsusFpqfHo9mD4O09C6UVraubhixlc80KegbgSSwTgj+KH+uFF
mZxfgXQPobNvJIB4tii4AVko8gNfDgHciIc1ywIDAQABMA0GCSqGSIb3DQEBCwUAA4GBAFhN800k
WS4GfeToknLIRzSz6V/gBtFYJumLizx83L4YrKfnm9rjkj5RO7REvaawlM2Ixfv329gJtJJdmDha
LVCVMU7bi0ESKp3dDjJJpW1mcNNAj6FcTbSYTS6pgu5cLsUAoGdh3+VFmmAyKb6cjRvBmHHyHx3p
wEpFpPQYNffn
</ds:X509Certificate>
</ds:X509Data>
</ds:KeyInfo>
</ds:Signature>




________________________________

To unsubscribe from this list send an email to dev-unsubscribe at shibboleth.net
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/dev/attachments/20130513/7b4db6a8/attachment-0001.html