error validating signature on Jboss

[Brent Putman]

On 5/13/13 3:37 PM, Mitu Singh wrote:
> Brent,
>
> I am using opensaml2.5.3. I see the same error when I use opensaml 2.6.0

Ok, either is plenty new enough for this to work properly.


>
> I am using xercesImpl-2.10.0, xalan-2.7.1

Are you endorsing those in your container, or just putting them in your
app classpath?  Doing the former may be necessary for this to work and
is part of our documented install requirements.


>
> I checked that the reference URI has the id of the response (although
> it does have a '#' before it)

That all looks correct.   The '#' is a local document fragment reference
and is the expected form.

I pulled your example into a little test class I wrote and it passed the
validator, as I expected it would.  So there's nothing wrong with the
OpenSAML code or the XML.  The only thing left I can think of is your
XML parsing environment.  Make sure you are endorsing Xalan and Xerces
and the related JAXP jars properly in your container.  I don't know of
any particular issues with older versions around something as
fundamental as DOM ID-ness, but it's the only thing else that comes to mind.

As a test, if you want to literally examine the aspect of the DOM that
appears to be at issue here, then you can dump out to your logging or
System.out something like this:

response.getDOM().getAttributeNodeNS(null, "ID").isId()

Also as a test, if you want to manually set the ID-ness before calling
the validator, you'd do something like this:

response.getDOM().setIdAttributeNS(null, "ID", true)

As a troubleshooting measure, I'd be interested to know whether that
resolves the problem or not. This is basically done by the Response
unmarshaller, but I'm wondering if for some reason it's not working in
your DOM tree.  If this doesn't work, then the issue is probably with
the XML environment, and/or there is something about your set up that
you're not telling us.


--Brent