OpenSAML and JBoss 7.1

Massimiliano Masi massimiliano.masi at gmail.com
Tue Nov 19 10:49:48 EST 2013 

Hi All,

I am migrating from JBoss 4.0.5 to JBoss 7.1. In this last version of
JBoss, the class loader is heavily changed. Unfortunately this caused
errors, I am not sure what can be the root cause of the exception attached.

I think it is an xml endorsing problem. Do you guys have any chance to run
opensaml in jboss out of the box? The assertion correctly validates in a
test environment (Junit under eclipse)

Thanks,


      Massi

org.opensaml.xml.validation.ValidationException: Unable to evaluate key
against signature

at
com.spirit.saml.validators.DefaultSAMLAssertionValidator.checkSignature(DefaultSAMLAssertionValidator.java:249)

at
com.spirit.saml.validators.DefaultSAMLAssertionValidator.validate(DefaultSAMLAssertionValidator.java:212)

at com.spirit.saml.validators.PoTValidator.validate(PoTValidator.java:64)

at
com.spirit.proxy.handler.security.ValidatePOTAssertionHandler.handleRq(ValidatePOTAssertionHandler.java:28)

... 24 more

Caused by: org.opensaml.xml.validation.ValidationException: Unable to
evaluate key against signature

at
org.opensaml.xml.signature.SignatureValidator.validate(SignatureValidator.java:74)

at
com.spirit.saml.sign.validators.DefaultSignatureValidator.validate(DefaultSignatureValidator.java:44)

at
com.spirit.saml.sign.validators.DefaultSignatureValidator.validate(DefaultSignatureValidator.java:143)

at
com.spirit.saml.validators.DefaultSAMLAssertionValidator.checkSignature(DefaultSAMLAssertionValidator.java:247)

... 27 more

Caused by:
org.apache.xml.security.signature.MissingResourceFailureException: The
Reference for URI #_48569591-5178-4af0-ba30-1d654c9c487c has no
XMLSignatureInput

Original Exception was
org.apache.xml.security.signature.ReferenceNotInitializedException: Cannot
resolve element with ID _48569591-5178-4af0-ba30-1d654c9c487c

Original Exception was
org.apache.xml.security.signature.ReferenceNotInitializedException: Cannot
resolve element with ID _48569591-5178-4af0-ba30-1d654c9c487c

Original Exception was
org.apache.xml.security.signature.ReferenceNotInitializedException: Cannot
resolve element with ID _48569591-5178-4af0-ba30-1d654c9c487c

Original Exception was
org.apache.xml.security.utils.resolver.ResourceResolverException: Cannot
resolve element with ID _48569591-5178-4af0-ba30-1d654c9c487c

at
org.apache.xml.security.signature.Manifest.verifyReferences(Manifest.java:414)

at org.apache.xml.security.signature.SignedInfo.verify(SignedInfo.java:259)

at
org.apache.xml.security.signature.XMLSignature.checkSignatureValue(XMLSignature.java:724)

at
org.opensaml.xml.signature.SignatureValidator.validate(SignatureValidator.java:69)

... 30 more

Caused by:
org.apache.xml.security.signature.ReferenceNotInitializedException: Cannot
resolve element with ID _48569591-5178-4af0-ba30-1d654c9c487c

Original Exception was
org.apache.xml.security.signature.ReferenceNotInitializedException: Cannot
resolve element with ID _48569591-5178-4af0-ba30-1d654c9c487c

Original Exception was
org.apache.xml.security.signature.ReferenceNotInitializedException: Cannot
resolve element with ID _48569591-5178-4af0-ba30-1d654c9c487c

Original Exception was
org.apache.xml.security.utils.resolver.ResourceResolverException: Cannot
resolve element with ID _48569591-5178-4af0-ba30-1d654c9c487c

at
org.apache.xml.security.signature.Reference.calculateDigest(Reference.java:726)

at org.apache.xml.security.signature.Reference.verify(Reference.java:761)

at
org.apache.xml.security.signature.Manifest.verifyReferences(Manifest.java:336)

... 33 more

Caused by:
org.apache.xml.security.signature.ReferenceNotInitializedException: Cannot
resolve element with ID _48569591-5178-4af0-ba30-1d654c9c487c

Original Exception was
org.apache.xml.security.signature.ReferenceNotInitializedException: Cannot
resolve element with ID _48569591-5178-4af0-ba30-1d654c9c487c

Original Exception was
org.apache.xml.security.utils.resolver.ResourceResolverException: Cannot
resolve element with ID _48569591-5178-4af0-ba30-1d654c9c487c

at
org.apache.xml.security.signature.Reference.dereferenceURIandPerformTransforms(Reference.java:621)

at
org.apache.xml.security.signature.Reference.calculateDigest(Reference.java:705)

... 35 more

Caused by:
org.apache.xml.security.signature.ReferenceNotInitializedException: Cannot
resolve element with ID _48569591-5178-4af0-ba30-1d654c9c487c

Original Exception was
org.apache.xml.security.utils.resolver.ResourceResolverException: Cannot
resolve element with ID _48569591-5178-4af0-ba30-1d654c9c487c

at
org.apache.xml.security.signature.Reference.getContentsBeforeTransformation(Reference.java:434)

at
org.apache.xml.security.signature.Reference.dereferenceURIandPerformTransforms(Reference.java:614)

... 36 more

Caused by:
org.apache.xml.security.utils.resolver.ResourceResolverException: Cannot
resolve element with ID _48569591-5178-4af0-ba30-1d654c9c487c

at
org.apache.xml.security.utils.resolver.implementations.ResolverFragment.engineResolve(ResolverFragment.java:86)

at
org.apache.xml.security.utils.resolver.ResourceResolver.resolve(ResourceResolver.java:279)

at
org.apache.xml.security.signature.Reference.getContentsBeforeTransformation(Reference.java:432)

... 37 more



 <saml2:Assertion ID="_48569591-5178-4af0-ba30-1d654c9c487c"
IssueInstant="2013-11-19T14:50:29.098Z" Version="2.0"
xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xs="
http://www.w3.org/2001/XMLSchema">

        <saml2:Issuer
Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified">urn:tiani-spirit:sts</saml2:Issuer>

        <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">

          <ds:SignedInfo>

            <ds:CanonicalizationMethod Algorithm="
http://www.w3.org/2001/10/xml-exc-c14n#"/>

            <ds:SignatureMethod Algorithm="
http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>

            <ds:Reference URI="#_48569591-5178-4af0-ba30-1d654c9c487c">

              <ds:Transforms>

                <ds:Transform Algorithm="
http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>

                <ds:Transform Algorithm="
http://www.w3.org/2001/10/xml-exc-c14n#">

                  <ec:InclusiveNamespaces PrefixList="xs" xmlns:ec="
http://www.w3.org/2001/10/xml-exc-c14n#"/>

                </ds:Transform>

              </ds:Transforms>

              <ds:DigestMethod Algorithm="
http://www.w3.org/2000/09/xmldsig#sha1"/>

              <ds:DigestValue>TeJNSuK5dBPxPBERW4V8mBgcQmE=</ds:DigestValue>

            </ds:Reference>

          </ds:SignedInfo>


<ds:SignatureValue>FckFNi27jqp2OgnU4DRP1e0UvLBoCuYzfu17Rps9K9X03rQ+jUSqPMKfUwXtIHvq0uZRFnZSPEDQlgfq+T5CrQw1UYlN2f+K2C5VSb/uGyt6IZQ9IPE0de9eAdPt0QD8gFiyKbCeYH4bxvXG+KKY3XDzsQ/g6Huzt9jFbM/S0TNhEElvyaY+J+pVx6/0bE7A4N5qKJ9GiyqGTbfuTw8gbhua1ip2upP6FJziaNsh0+MqZUbo8Sbd/XuIERFkABlN0ilWeJQbAnw06rcRg6FXLu8XxuchlvJ1eJ0HR8+GildlqEp50ZlgHRZncezMqS0ClD0YsPpFAurMze45bhe40g==</ds:SignatureValue>

          <ds:KeyInfo>

            <ds:X509Data>


<ds:X509Certificate>MIIEQTCCAymgAwIBAgIBAzANBgkqhkiG9w0BAQUFADCBrDELMAkGA1UEBhMCQVQxEDAOBgNVBAgT

B0F1c3RyaWExDzANBgNVBAcTBlZpZW5uYTEaMBgGA1UEChMRVGlhbmkgU3Bpcml0IEdtYkgxGTAX

BgNVBAsTEERlbW8gRW52aXJvbm1lbnQxEDAOBgNVBAMTB1Rlc3QgQ0ExMTAvBgkqhkiG9w0BCQEW

Im1hc3NpbWlsaWFuby5tYXNpQHRpYW5pLXNwaXJpdC5jb20wIBcNMTEwNzI3MDgyMTUyWhgPMjE5

MDEyMzEwODIxNTJaMIGbMQswCQYDVQQGEwJBVDEQMA4GA1UECBMHQXVzdHJpYTEaMBgGA1UEChMR

VGlhbmkgU3Bpcml0IEdtYkgxGTAXBgNVBAsTEERlbW8gRW52aXJvbm1lbnQxEDAOBgNVBAMTB3Nl

cnZlcjExMTAvBgkqhkiG9w0BCQEWIm1hc3NpbWlsaWFuby5tYXNpQHRpYW5pLXNwaXJpdC5jb20w

ggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDcEpmyaFK8aKKrvaFZL6IGttOwI3ImGCUi

wINIc+fcuVWRyT7Deb8tymnwVBfHVD/8Mh5ufwiS9YU774Ta2aB8H/Gwr5QIndu4eG9+adDEV3+D

i6e3HhiA/8RP8CXCMGY4LOAjaNwUh/EEsn1S2oa+Dsiff5Ba8wmddc6pyYiwmhDfwEF0YBXDjvB8

iexcLcOLvo/pl2hP87g/ptDXy0VUWWPzX9qxc6YtqhkS7EtmhzMW5deWvmRiPzJ2NVfCuvpcsK2T

ii+MgCYbLXCLYkCg+5ZpV7esrqb5hWOf2tKUsDlu/sjck2lflsWTE1woKr0tbp7IxLzvGKx9hERB

0hzJAgMBAAGjezB5MAkGA1UdEwQCMAAwLAYJYIZIAYb4QgENBB8WHU9wZW5TU0wgR2VuZXJhdGVk

IENlcnRpZmljYXRlMB0GA1UdDgQWBBQU7M3dSaInYi+0MCDYpbACOCjvBzAfBgNVHSMEGDAWgBRk

wihuUTlGpNDxrnZFbW84FXj72jANBgkqhkiG9w0BAQUFAAOCAQEAjEqNtOb2Hk6BpBDRXk9vd+0v

vJSOWvdZnL3I2Kr30oN6nQOMud68FPI1JC1QwLni05ZVDTyMYOk/HRPK2jSByFmLZECaE6Q5Z1BT

D9vR/AqtmTOvub922uS5gTpVEWijSW1o9j+LFzGC4k8l4xWidPtKa3o1aXSGcWSw0i1BKgxM3pMz

SvKieZ2KQaHgZSb7bfk4uR4kAaida5hv6kveiDKRRG+8AeBvBD5lofaqUaUN9q/YIOucc8gHQBzG

rmkObvyykzyPz5wddLmouqrZZqfufPTNh4whyABbXCPXsptDZZss8DlKS37rFVUKLHEhcfd1J+IO

ioaTnaPhgY/dXg==</ds:X509Certificate>

            </ds:X509Data>

          </ds:KeyInfo>

        </ds:Signature>

        <saml2:Subject>

          <saml2:NameID
Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress">doctor1</saml2:NameID>

          <saml2:SubjectConfirmation
Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"/>

        </saml2:Subject>

        <saml2:Conditions NotBefore="2013-11-19T14:50:29.098Z"
NotOnOrAfter="2013-11-19T18:10:29.098Z">

          <saml2:AudienceRestriction>

            <saml2:Audience>
http://ihe.connecthaton.XUA/X-ServiceProvider-IHE-Connectathon<http://ihe.connecthaton.xua/X-ServiceProvider-IHE-Connectathon>
</saml2:Audience>

          </saml2:AudienceRestriction>

        </saml2:Conditions>

        <saml2:AuthnStatement AuthnInstant="2013-11-19T14:50:29.098Z"
SessionIndex="123456" SessionNotOnOrAfter="2013-11-19T18:10:29.098Z">

          <saml2:AuthnContext>


<saml2:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:Password</saml2:AuthnContextClassRef>

          </saml2:AuthnContext>

        </saml2:AuthnStatement>

        <saml2:AttributeStatement>

          <saml2:Attribute FriendlyName="XSPA Subject"
Name="urn:oasis:names:tc:xacml:1.0:subject:subject-id"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">

            <saml2:AttributeValue xmlns:xsi="
http://www.w3.org/2001/XMLSchema-instance"
xsi:type="xs:string">SpiritDoctor1 Doctor1</saml2:AttributeValue>

          </saml2:Attribute>

          <saml2:Attribute FriendlyName="XSPA Role"
Name="urn:oasis:names:tc:xacml:2.0:subject:role"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">

            <saml2:AttributeValue xmlns:xsi="
http://www.w3.org/2001/XMLSchema-instance"
xsi:type="xs:string">Physician</saml2:AttributeValue>

          </saml2:Attribute>

          <saml2:Attribute FriendlyName="XSPA Organization"
Name="urn:oasis:names:tc:xspa:1.0:subject:organization"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">

            <saml2:AttributeValue xmlns:xsi="
http://www.w3.org/2001/XMLSchema-instance"
xsi:type="xs:string">SpiritSite1</saml2:AttributeValue>

          </saml2:Attribute>

          <saml2:Attribute FriendlyName="XSPA Organization ID"
Name="urn:oasis:names:tc:xspa:1.0:subject:organization-id"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">

            <saml2:AttributeValue xmlns:xsi="
http://www.w3.org/2001/XMLSchema-instance"
xsi:type="xs:anyURI">1.3.6.1.4.1.21998.1.901</saml2:AttributeValue>

          </saml2:Attribute>

          <saml2:Attribute FriendlyName="XSPA Purpose of Use"
Name="urn:oasis:names:tc:xspa:1.0:subject:purposeofuse"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">

            <saml2:AttributeValue xmlns:xsi="
http://www.w3.org/2001/XMLSchema-instance"
xsi:type="xs:string">TREATMENT</saml2:AttributeValue>

          </saml2:Attribute>

        </saml2:AttributeStatement>

      </saml2:Assertion>

-- 
Massimiliano Masi

http://www.mascanc.net/~max
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/dev/attachments/20131119/16a3b9f2/attachment-0001.html

More information about the dev mailing list