Signing and validating using the same credential

[Brent Putman]

On 12/8/14 10:33 AM, Pascal Mainini wrote:
> Issue solved: in fact, your hint with pretty-printing noticed me of an
> issue with the generating code - thus the content was effectively
> altered *after* signature. 

Yes, that will definitely cause a problem.


>
> However, it's also a bit the error message of the validator which got me
> slightly on the wrong track:
>
>>> "Signature did not validate against the credential's key"
> I assumed that there must be an issue with the key - and not with the
> signature ;-)


The output we get back from the Santuario XMLSignature validation call
is just a boolean.  There's no info supplied about why the call failed,
so OpenSAML can't return anything more specific.  Only way to get that
is by turning up debug logging on the Santuario packages.

That said, if one did not know that, our message does sort of imply that
the failure has something to do with the key.  Perhaps we should change
that to a more neutral message that doesn't imply anything specific,
only that validation failed.  I'll think about it and try and come up
with a better log and exception message.