XML signature validation

[Sandy]

Hello Brent,

I have been able to validate the signature successfully and am now working
on establishing trust. I am using ExplicitKeySignatureTrustEngine as it
suits my needs like you suggested. I have not been successful with this and
have a few questions that might clear my understanding and hence my way.

1. In the xmltooling test, *testSuccess()* in
*ExplicitKeySignatureTrustEngineTest
*(org.opensaml.xml.signature.ExplicitKeySignatureTrustEngineTest), during
setUp(), we create signingX509Cred of type BasicX509Credential and set a
private key to it. If I understood the test correctly, the test(and
ExplicitKeySignatureTrustEngine) uses the trusting credentials supplied as
a list(trustedCredentials) as opposed to the default trust store. My
understanding is that a trust store does not require a private key. If I
comment out adding the private key(signingPrivateKey), the test fails.
Either my understanding of the test is wrong, or I am missing something by
a long shot. Hope I put my confusion clearly.

2. In my implementation for establishing trust, I am running into an
exception(pasted at the bottom for legibility). I found this related
discussion from 2013
<http://comments.gmane.org/gmane.comp.web.shibboleth.devel/4222>. By any
chance, have you come across the root cause for this? I debugged through
the error and found that the failure is at
org.apache.commons.ssl.KeyStoreBuilder.parse(byte[], char[], char[]) of
the  not-yet-commons-ssl library. Apparently, it was not able to return a
BuildResult object and throws the exception at the end.

Thank you for your patience and help.

Regards,
Sundeep

Exception stack trace:

org.opensaml.xml.security.SecurityException: Error extracting certificates
from X509Data
    at
org.opensaml.xml.security.keyinfo.provider.InlineX509DataProvider.extractCertificates(InlineX509DataProvider.java:195)
    at
org.opensaml.xml.security.keyinfo.provider.InlineX509DataProvider.process(InlineX509DataProvider.java:126)
    at
org.opensaml.xml.security.keyinfo.BasicProviderKeyInfoCredentialResolver.processKeyInfoChild(BasicProviderKeyInfoCredentialResolver.java:300)
    at
org.opensaml.xml.security.keyinfo.BasicProviderKeyInfoCredentialResolver.processKeyInfoChildren(BasicProviderKeyInfoCredentialResolver.java:256)
    at
org.opensaml.xml.security.keyinfo.BasicProviderKeyInfoCredentialResolver.processKeyInfo(BasicProviderKeyInfoCredentialResolver.java:190)
    at
org.opensaml.xml.security.keyinfo.BasicProviderKeyInfoCredentialResolver.resolveFromSource(BasicProviderKeyInfoCredentialResolver.java:149)
    at
org.opensaml.xml.security.credential.AbstractCriteriaFilteringCredentialResolver.resolve(AbstractCriteriaFilteringCredentialResolver.java:57)
    at
org.opensaml.xml.security.credential.AbstractCriteriaFilteringCredentialResolver.resolve(AbstractCriteriaFilteringCredentialResolver.java:37)
    at
org.opensaml.xml.signature.impl.BaseSignatureTrustEngine.validate(BaseSignatureTrustEngine.java:99)
    at
org.opensaml.xml.signature.impl.ExplicitKeySignatureTrustEngine.validate(ExplicitKeySignatureTrustEngine.java:100)
    //.. Lines omitted
Caused by: java.security.cert.CertificateException: Unable to decode X.509
certificates
    at
org.opensaml.xml.security.x509.X509Util.decodeCertificate(X509Util.java:362)
    at
org.opensaml.xml.security.keyinfo.KeyInfoHelper.getCertificate(KeyInfoHelper.java:201)
    at
org.opensaml.xml.security.keyinfo.KeyInfoHelper.getCertificates(KeyInfoHelper.java:176)
    at
org.opensaml.xml.security.keyinfo.provider.InlineX509DataProvider.extractCertificates(InlineX509DataProvider.java:192)
    ... 34 more
Caused by: java.security.KeyStoreException: failed to extract any
certificates or private keys - maybe bad password?
    at
org.apache.commons.ssl.KeyStoreBuilder.parse(KeyStoreBuilder.java:443)
    at org.apache.commons.ssl.TrustMaterial.<init>(TrustMaterial.java:213)
    at org.apache.commons.ssl.TrustMaterial.<init>(TrustMaterial.java:165)
    at
org.opensaml.xml.security.x509.X509Util.decodeCertificate(X509Util.java:359)
    ... 37 more


On Mon, Dec 15, 2014 at 9:24 PM, Brent Putman <putmanb at georgetown.edu>
wrote:
>
>
> On 12/15/14 2:51 PM, Sandy wrote:
>
>   Thank you Brent.
>
>  The SP is built with OpenSAML Java(2.6.3). Like you correctly guessed, at
> the moment I am looking to resolve a Credential from KeyInfo.
>
>
> We have a KeyInfoCredentialResolver exactly for that purpose.  That's an
> interface.  For the signature validation processing case, the main impl to
> look at is:
> org.opensaml.xml.security.keyinfo.BasicProviderKeyInfoCredentialResolver.
>
> You can get a basic instance of that with the typical providers already
> wired in (suitable for your use case) from:
>
> Configuration.getGlobalSecurityConfiguration().getDefaultKeyInfoCredentialResolver()
>
> The unit tests should give you usage examples.
>
>
>
>
>  Thank you for the advise on establishing trust. I now understand how
> important it is and I would implement it. The more complex example at the
> bottom serves as a great resource for this.
>
>
> That example illustrates the trust establishment using SAML metadata, b/c
> that is the trusted CredentialResolver that is specified.  If you wanted to
> use a different source of trusted Credentials for the
> ExplicitKeySignatureTrustEngine, you would just swap out the metadata-based
> one for a different one.  There are several CredentialResolver impls.
>
>
>  If there happen to be examples citing the usage of credential resolvers
> and a basic signature trust engine, it would be great to know them. I plan
> on using a local trust store at the SP for establishing the trust.
>
>
> Well, that example in the wiki is pretty complete, as far as just using
> the trust engine.  Other than that, there's just unit tests and the
> Shibboleth IdP, which is built on top of all of this.  I don't know what
> exactly you want to know, but if you have specific questions, just post
> them here.
>
> --Brent
>
>
> --
> To unsubscribe from this list send an email to
> dev-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/dev/attachments/20141217/9e92383f/attachment.html