DOM exception while parsing signed SAML request with extensions

Tue Oct 22 10:54:07 EDT 2013

Hi All,

I am trying to send the xs:anyType element XML in signed SAML request
 extensions.
 In order to bypass the signature verification by the shibboleth, I took out
 all the Secruty policy rules from relying-party.xml file. I am doing
 signature verification and CRL check on my own in external login handler.

My understanding is Extensions can accpet any valid XMLs. If the extensions
has XML without signature elements inside, the signed SAML request is
parsing successfully. If I add any XML to extensions which has signature
elements getting below error.

ERROR

[edu.internet2.middleware.shibboleth.common.profile.ProfileRequestDispatcherServlet:89]
 - Error occurred while processing request
 org.w3c.dom.DOMException: Cannot find Reference in Manifest
             at org.apache.xml.security.signature.Manifest.<init>(Unknown
 Source) ~[xmlsec.jar:na]
             at org.apache.xml.security.signature.SignedInfo.<init>(Unknown
 Source) ~[xmlsec.jar:na]
             at
org.apache.xml.security.signature.XMLSignature.<init>(Unknown
 Source) ~[xmlsec.jar:na]
             at

org.opensaml.xml.signature.impl.SignatureUnmarshaller.unmarshall(SignatureUnmarshaller.java:64)
 ~[xmltooling.jar:na]
             at

org.opensaml.xml.signature.impl.SignatureUnmarshaller.unmarshall(SignatureUnmarshaller.java:41)
 ~[xmltooling.jar:na]
             at

org.opensaml.xml.io.AbstractXMLObjectUnmarshaller.unmarshallChildElement(AbstractXMLObjectUnmarshaller.java:335)
 ~[xmltooling.jar:na]
             at

org.opensaml.xml.io.AbstractXMLObjectUnmarshaller.unmarshall(AbstractXMLObjectUnmarshaller.java:122)
 ~[xmltooling.jar:na]
             at

org.opensaml.xml.io.AbstractXMLObjectUnmarshaller.unmarshallChildElement(AbstractXMLObjectUnmarshaller.java:335)
 ~[xmltooling.jar:na]
             at

org.opensaml.xml.io.AbstractXMLObjectUnmarshaller.unmarshall(AbstractXMLObjectUnmarshaller.java:122)
 ~[xmltooling.jar:na]
             at

org.opensaml.xml.io.AbstractXMLObjectUnmarshaller.unmarshallChildElement(AbstractXMLObjectUnmarshaller.java:335)
 ~[xmltooling.jar:na]
             at

org.opensaml.xml.io.AbstractXMLObjectUnmarshaller.unmarshall(AbstractXMLObjectUnmarshaller.java:122)
 ~[xmltooling.jar:na]
             at

org.opensaml.xml.io.AbstractXMLObjectUnmarshaller.unmarshallChildElement(AbstractXMLObjectUnmarshaller.java:335)
 ~[xmltooling.jar:na]
             at

org.opensaml.xml.io.AbstractXMLObjectUnmarshaller.unmarshall(AbstractXMLObjectUnmarshaller.java:122)
 ~[xmltooling.jar:na]
             at

org.opensaml.xml.io.AbstractXMLObjectUnmarshaller.unmarshallChildElement(AbstractXMLObjectUnmarshaller.java:335)
 ~[xmltooling.jar:na]
             at

org.opensaml.xml.io.AbstractXMLObjectUnmarshaller.unmarshall(AbstractXMLObjectUnmarshaller.java:122)
 ~[xmltooling.jar:na]
             at

org.opensaml.xml.io.AbstractXMLObjectUnmarshaller.unmarshallChildElement(AbstractXMLObjectUnmarshaller.java:335)
 ~[xmltooling.jar:na]
             at

org.opensaml.xml.io.AbstractXMLObjectUnmarshaller.unmarshall(AbstractXMLObjectUnmarshaller.java:122)
 ~[xmltooling.jar:na]
             at

org.opensaml.ws.message.decoder.BaseMessageDecoder.unmarshallMessage(BaseMessageDecoder.java:203)
 ~[openws.jar:na]
             at

org.opensaml.saml2.binding.decoding.HTTPPostDecoder.doDecode(HTTPPostDecoder.java:91)
 ~[opensaml.jar:na]
             at

org.opensaml.ws.message.decoder.BaseMessageDecoder.decode(BaseMessageDecoder.java:79)
 ~[openws.jar:na]
             at

org.opensaml.saml2.binding.decoding.BaseSAML2MessageDecoder.decode(BaseSAML2MessageDecoder.java:70)
 ~[opensaml.jar:na]
             at

edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.decodeRequest(SSOProfileHandler.java:332)
 ~[shibboleth-identityprovider.jar:na]
             at

edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.performAuthentication(SSOProfileHandler.java:190)
 ~[shibboleth-identityprovider.jar:na]
             at

edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.processRequest(SSOProfileHandler.java:161)
 ~[shibboleth-identityprovider.jar:na]
             at

edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.processRequest(SSOProfileHandler.java:88)
 ~[shibboleth-identityprovider.jar:na]
             at

edu.internet2.middleware.shibboleth.common.profile.ProfileRequestDispatcherServlet.service(ProfileRequestDispatcherServlet.java:84)
 ~[shibboleth-common.jar:na]
             at javax.servlet.http.HttpServlet.service(HttpServlet.java:717)
 [servlet-api.jar:na]
             at

org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290)
 [catalina.jar:6.0.32]
             at

org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
 [catalina.jar:6.0.32]

The sample that I used for this test

===============

<ns3:AuthnRequest
    xmlns:ns3="urn:oasis:names:tc:SAML:2.0:protocol"
    xmlns="urn:oasis:names:tc:SAML:2.0:assertion"
    xmlns:ns2="http://www.w3.org/2000/09/xmldsig#"
    xmlns:ns4="http://www.w3.org/2001/04/xmlenc#"

AssertionConsumerServiceURL="https://sp.browse.test.com/idptester/checkuser.jsp"
    Destination="https://idp.test.com/idp/profile/SAML2/POST/SSO"
    ForceAuthn="true"
    ID="_51445c63ed09b24499ca2c5f895fc23"
    IssueInstant="2013-10-21T14:40:28.796Z"
    ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
    Version="2.0">
    <Issuer>
        https://sp.browse.test.com/
    </Issuer>
    <ns3:Extensions>
        <Sc:CustomTag ID="ID_111111111" xmlns:Sc="urn:test:saml:Sc.01" 
					xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
					xsi:schemaLocation="urn:test:saml:Sc.01 Sc.01.xsd">
					<saml2p:Response
						    xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol"
						    Destination="http://spweb.test.com/cgi-bin/samldecoder.pl"
						    ID="_3a79f88b138bacaf21763fb70c871144"
						    InResponseTo="_l0k8-tpzk-ann5-9rkl-fw28-k1mi-e7un-kxsq"
						    IssueInstant="2013-10-21T14:57:22.576Z"
						    Version="2.0">
						    <saml2:Issuer
						        xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"
						        Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">
						        https://idp.testnet.test.com/idp
						    </saml2:Issuer>
						    <saml2p:Status>
						        <saml2p:StatusCode
						            Value="urn:oasis:names:tc:SAML:2.0:status:Success"/>
						    </saml2p:Status>
						    <saml2:Assertion
						        xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"
						        ID="_e0bb8d3984ab795acb213754ec23be97"
						        IssueInstant="2013-10-21T14:57:22.576Z"
						        Version="2.0"
						        xmlns:xs="http://www.w3.org/2001/XMLSchema">
						        <saml2:Issuer
						            Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">
						            https://idp.testnet.test.com/idp
						        </saml2:Issuer>
						        <ds:Signature
						            xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
						            <ds:SignedInfo>
						                <ds:CanonicalizationMethod

Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
						                <ds:SignatureMethod

Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/>
						                <ds:Reference
						                    URI="#_e0bb8d3984ab795acb213754ec23be97">
						                    <ds:Transforms>
						                        <ds:Transform

Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
						                        <ds:Transform

Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#">
						                            <ec:InclusiveNamespaces

xmlns:ec="http://www.w3.org/2001/10/xml-exc-c14n#"
						                                PrefixList="xs"/>
						                        </ds:Transform>
						                    </ds:Transforms>
						                    <ds:DigestMethod

Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
						                    <ds:DigestValue>
						                        MXz9pSaYBsOhxrKVxK26ypDHlxfzWrpF214RdXS6o2Y=
						                    </ds:DigestValue>
						                </ds:Reference>
						            </ds:SignedInfo>
						            <ds:SignatureValue>

JUcc3iVr/tuY4x1xP+zw1WC+LubNSVWIMd3v6Q0P1R7qgVbKF8kLfoAnYEGp5Yqqo2qXMUip7F9pA9Gj8fCbQ0+VJnGsXFepCA63NPcUnnkY/h08fU+yteS/h5ZWnBjjj+KXN+bnwGyf612SNL9o8jR80oaEhE44KNqflTdzYd0HbInqjjvAVuuOBbb9Ifqsy6TsEHQ9Pl8Lu4EmmqTJ0/yrZoYPh6WVFcjZMGqgd/DHLokNEBRI5Z6PGsvL5Y1sG9MhJSQBysv6WUq4SO2rI9LRGERr2CwxmxwlFt1BlRG1Z4NOvcxdLScBZ9MpvVhPS4fACYX//Ey+5fFddB37zQ==
						            </ds:SignatureValue>
						            <ds:KeyInfo>
						                <ds:X509Data>
						                    <ds:X509Certificate>

MIIDvDCCAqSgAwIBAgIETMxEnTANBgkqhkiG9w0BAQUFADAQMQ4wDAYDVQQKEwVTV0lGVDAeFw0x

MTEyMjkyMTQ0MjFaFw0xMzEyMjkyMjE0MjFaMEExDjAMBgNVBAoTBXN3aWZ0MQ4wDAYDVQQKEwVz

d2lmdDERMA8GA1UEAxMIc3dpZnRpZHAxDDAKBgNVBAMUAyUxMTCCASIwDQYJKoZIhvcNAQEBBQAD

ggEPADCCAQoCggEBAIiEnhUL51QksCkzoRYO22RzmMBXw9DKMOBrcTziqelnm6Lg06VYys6JfF0/

8J1DCU8lIDSTSDAsaSXsimEi219AvVoICtx+8DLULq1JgaXF/3qv2ffRAQoMhZ4h5pKmYHcZme5T

1FkgxGWL7KDwSMH0KoZ/BM4nP2stBZnqZhRJ4bFV4HcMjrzYAi9NYEHxsNkOKmc0y3bfPltV16tG

LQYHqwfJo1lhgkZiZpMp4qSN2DGISuxuW//+oGh5SOj8/DC90daiSqfrQoiveGNjcfXYlaHB9GqO

ZNGVRPJGUk7pN3h7EPUXjlRz2adf0uDQ4G+FU2bZclCmyEzXU+x3ZwsCAwEAAaOB7DCB6TALBgNV

HQ8EBAMCBaAwKwYDVR0QBCQwIoAPMjAxMTEyMjkyMTQ0MjFagQ8yMDEzMDYzMDA0MTQyMVowEQYJ

YIZIAYb4QgEBBAQDAgZAMDQGA1UdHwQtMCswKaAnoCWkIzAhMQ4wDAYDVQQKEwVTV0lGVDEPMA0G

A1UEAxMGQ1JMNTMwMB8GA1UdIwQYMBaAFI+vVryAd6P9ntKJg5j+mMcgZSPMMB0GA1UdDgQWBBSa

VNlZ5nTx4xUcm3ZwCIH90xcmzzAJBgNVHRMEAjAAMBkGCSqGSIb2fQdBAAQMMAobBFY3LjEDAgOo

MA0GCSqGSIb3DQEBBQUAA4IBAQA340g5S24vqrnM/Y2lq6CLrZncSeO47WELNKJF/XWMLqy11BvM

Hyc0qiMRLgVbjI3NqOAi+5yDXm4p1dSHclO40pJzDAg+sIdFKZXJS2GvqJvZfiejIrX7T/f3Lyb6

3NWSZw2mIEDVd2dAzR02w23bOmoMdqucggVh7HBZ0driqIKIxBenJd14eWr9V4WxuojgJaWU2DIq

TiMa18G0bF2yAo6SwNdX2Vk1vZtSijvoDY6XFGz/IbVHE8Gpkctl9JjxNeBlx6egavfi/PAR7DOC

q0D5lIgMIIOf1XWakOGQPBJelkLZW2FHrG/69tJJ+frk7BE3PqHHv198GpA+LDqQ
						                    </ds:X509Certificate>
						                </ds:X509Data>
						            </ds:KeyInfo>
						        </ds:Signature>
						        <saml2:Subject>
						            <saml2:NameID

Format="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"
						                NameQualifier="https://idp.testnet.test.com/idp"
						                SPNameQualifier="http://spweb.test.com/">
						                x8+NhaQyC7ASd0B8t0zSd3+XZZk=
						            </saml2:NameID>
						            <saml2:SubjectConfirmation
						                Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
						                <saml2:SubjectConfirmationData
						                    Address="10.8.160.152"

InResponseTo="_l0k8-tpzk-ann5-9rkl-fw28-k1mi-e7un-kxsq"
						                    NotOnOrAfter="2013-10-21T15:02:22.576Z"

Recipient="http://spweb.test.com/cgi-bin/samldecoder.pl"/>
						            </saml2:SubjectConfirmation>
						        </saml2:Subject>
						        <saml2:Conditions
						            NotBefore="2013-10-21T14:57:22.576Z"
						            NotOnOrAfter="2013-10-21T15:02:22.576Z">
						            <saml2:AudienceRestriction>
						                <saml2:Audience>
						                    http://spweb.test.com/
						                </saml2:Audience>
						            </saml2:AudienceRestriction>
						        </saml2:Conditions>
						        <saml2:AuthnStatement
						            AuthnInstant="2013-10-21T14:57:22.465Z"

SessionIndex="0116595cfe1789c9c067b4e4c7e422e6a9aaa9874a6401e17ede34e7dc82128a">
						            <saml2:SubjectLocality
						                Address="10.8.160.152"/>
						            <saml2:AuthnContext>
						                <saml2:AuthnContextClassRef>
						                    urn:oasis:names:tc:SAML:2.0:ac:classes:X509
						                </saml2:AuthnContextClassRef>
						            </saml2:AuthnContext>
						        </saml2:AuthnStatement>
						        <saml2:AttributeStatement>
						            <saml2:Attribute
						                Name="SubjectDN"

NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
						                <saml2:AttributeValue

xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
						                    xsi:type="xs:string">
						                    cn=testuser,ou=users,o=sporgdn1,o=test
						                </saml2:AttributeValue>
						            </saml2:Attribute>
						        </saml2:AttributeStatement>
						    </saml2:Assertion>
						</saml2p:Response>
				</Sc:CustomTag>
    </ns3:Extensions>
    <Signature
        xmlns="http://www.w3.org/2000/09/xmldsig#">
        <SignedInfo>
            <CanonicalizationMethod

Algorithm="http://www.w3.org/TR/2001/REC-xml-c14n-20010315#WithComments"/>
            <SignatureMethod

Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/>
            <Reference
                URI="#_51445c63ed09b24499ca2c5f895fc23">
                <Transforms>
                    <Transform

Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
                </Transforms>
                <DigestMethod
                    Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
                <DigestValue>
                    sWWwWPc5qefACtgIdwxXK9h7DCcv8c3P4coeX19yd5w=
                </DigestValue>
            </Reference>
        </SignedInfo>
        <SignatureValue>

JCDwo8gleAiYQo1Enjd3TU7wgg9pIc1W1V94p1dcBSIECDohRg8LBk1v16RVduAFaX2PKLPT5qo3

S84lYzrQiyxowNrYW2whQmecDJpJsSMcPw7OE9RQHE+mqxFvoF7CgOylWFLkk8ixfKkBWO8qz77x

6SecGuk76vY5Zu8LD7suczvvQthzw7l1ctagU0oNq2m4rERvNaNFB9pTwTd+GBYypjle8Rzp++/Z

6pF69i+J96aBzvbRNfDB/qy2k3iTKHC42JHzv5FBkBbQXcImISexjpUBfmhpRzYl+V802UmOJfxO
            esSfVC3Br6dzZ+xjhL+/ylAFICj3ZwG2fAWtEw==
        </SignatureValue>
        <KeyInfo>
            <X509Data>
                <X509SubjectName>
                    CN=sp-dn-test,O=sporgdn1,C=ww
                </X509SubjectName>
                <X509Certificate>

MIIDzDCCArSgAwIBAgIETMxISTANBgkqhkiG9w0BAQUFADAQMQ4wDAYDVQQKEwVTV0lGVDAeFw0x

MjAxMTAyMTE5MjVaFw0xNDAxMTAyMTQ5MjVaMDoxCzAJBgNVBAYTAnd3MREwDwYDVQQKEwhib3Nz

dXMzMzEYMBYGA1UEAxMPc3AtYnJvd3NlLXN3aWZ0MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB

CgKCAQEAixOnS9JqBfVPamfDPFcMinypKr8Fulm/e6N9eSHQBq1Uq2UGbNEJdDf1nV2RBX848PWn

pFtk+NmYaUsv2KvRmIrqrhCDhTBaLt8cj0D/kRfChLvLxG3Xpu/UDcKoXHM9vpFeml8qL/2wILqd

0MsZt16+MxfhxVuL7N3YiVmaPKM+doio9MzlrDMcfuBySGIhMgHrA35q+FYbnXs6E/kxYGMrvoDc

oC9OEoOXuu6Pl6+0K+u/3/fKxRZ6qL+5u/1KbyR1jr4ZHIbq7DA8qKzlNRdP7CtFWVbDjBiPPJu8

NzSHhmi6Ft0IsxzYWhxYYDnF4Sd5rZab6eyLGNFofgIMYQIDAQABo4IBAjCB/zALBgNVHQ8EBAMC

BaAwKwYDVR0QBCQwIoAPMjAxMjAxMTAyMTE5MjVagQ8yMDEzMDcxMjAzNDkyNVowEQYJYIZIAYb4

QgEBBAQDAgWgMBQGA1UdIAQNMAswCQYHKxUGBgpkBDA0BgNVHR8ELTArMCmgJ6AlpCMwITEOMAwG

A1UEChMFU1dJRlQxDzANBgNVBAMTBkNSTDUzMDAfBgNVHSMEGDAWgBSPr1a8gHej/Z7SiYOY/pjH

IGUjzDAdBgNVHQ4EFgQU0ordUl0b/kqPM0eNLlj9wF7bm1EwCQYDVR0TBAIwADAZBgkqhkiG9n0H

QQAEDDAKGwRWNy4xAwIDqDANBgkqhkiG9w0BAQUFAAOCAQEAYgHjVSo2AOkDj0NOj3Ep7Xz1BJHc

6p2v2NQyw3ZoN8J2mF76BtrIaay/vDbD08EAiI85EdfwQnwr3jk5cqz/jtEiBdd+17IExu+pOBHK

oJ7gVh9E7roAJd9RuLSK6uWQ3BVT1KzkWfCqf7xPn3gg5g7no9ki0wV1AX9fT/PhVB1mnEVC4/4d

CsgAtQkcypeS74iPCldSQyQg+yDbx4Xjej+3EcYNS+1KFYh19p0ZGOd9ZCf888irvkZs83bGufPx

nVoUrZmxetFpGnOhe+LIz3IuhS36p+IJs7jE0+Ra9iszZDS7y22WutPZU0XRCALTJHR0QRtL2yhg
                    CO7OZjQIfw==
                </X509Certificate>
            </X509Data>
        </KeyInfo>
    </Signature>
</ns3:AuthnRequest>

===============

Can you please help me to fix this issue. If you need any additional
information, I can provide.

Thanks,
Kotesh

--
View this message in context: http://shibboleth.1660669.n2.nabble.com/DOM-exception-while-parsing-signed-SAML-request-with-extensions-tp7590767.html
Sent from the Shibboleth - Developers mailing list archive at Nabble.com.