error validating signature on Jboss

[Brent Putman]

On 5/13/13 7:25 PM, Mitu Singh wrote:
> Brent,
>
> I am endorsing the jars on my server.
>
> I am printing the response xml using the following code before I
> validate the signature:
>

Ah, yes, that would be the problem then.

>         
>
> If I comment out the above code, the signature validator validates
> corrrectly. Does the above code in anyway modify the Response?

It doesn't modify the Response per se, but what you are telling it to do
is re-marshall the DOM, and that has consequences.  As part of
marshalling, the DOM tree gets adopted into a new Document, and that
causes ID-ness to be lost.  I vaguely remembered this coming up before,
here's a couple of links I found [1][2].

The gist is that losing ID-ness on adoption is the expected behavior of
Xerces.  So when you remarshall, the ID-ness that was set by the
unmarshaller is being undone by the marshalling process.  There's not
much we can do about that in OpenSAML, I think.

So don't do that.  :-) Note that if you just want to log the received
protocol message, and you are using our decoder, you can just set a
special logging category of "PROTOCOL_MESSAGE" to level DEBUG in your
logging config, and it will get logged to that category.  If not using
our decoder, you can also just grab the unmarshalled element directly by
using response.getDOM(), avoiding the need to actually explicitly
marshall the XMLObject again.

--Brent


[1] https://issues.apache.org/jira/browse/XERCESJ-1022
[2]
http://apache-xml-project.6118.n7.nabble.com/importNode-adoptNode-and-getElementById-td1526.html