XML signature validation

[Sandy]

Update:

I was able to get past the error. It was an error from my side. We were
using opensaml v 2.6.3 and xmltooling v.1.4.3, the latest versions when we
started the development. XMLtooling v.1.4.3 depends on not-yet-commons-ssl
v. 0.3.9. For some unknown reason or due to error, our maven was configured
to depend on not-yet-commons-ssl v.0.3.11. I noticed it and changed it to
v.0.3.9 and the exception went away and everything worked fine. Bottom
line, use the same version that xmltooling library originally used.

So, question 2 from my previous mail is now cleared, but question 1 still
puzzles me. In my implementation, I was able to validate by extracting just
the x509cert from my trust store(i.e. without adding a private key to the
BasicX509Credential), but the validation in the unit test(explained in my
earlier mail) fails, when I comment out addition of private key to the
signingX509Cred(BasicX509Credential). Any pointers will be helpful and are
appreciated.

Thank you for the help. Have a great day!

Regards,
Sundeep



On Wed, Dec 17, 2014 at 7:26 PM, Sandy <sundeep.nitw at gmail.com> wrote:
>
> Hello Brent,
>
> I have been able to validate the signature successfully and am now working
> on establishing trust. I am using ExplicitKeySignatureTrustEngine as it
> suits my needs like you suggested. I have not been successful with this and
> have a few questions that might clear my understanding and hence my way.
>
> 1. In the xmltooling test, *testSuccess()* in *ExplicitKeySignatureTrustEngineTest
> *(org.opensaml.xml.signature.ExplicitKeySignatureTrustEngineTest), during
> setUp(), we create signingX509Cred of type BasicX509Credential and set a
> private key to it. If I understood the test correctly, the test(and
> ExplicitKeySignatureTrustEngine) uses the trusting credentials supplied
> as a list(trustedCredentials) as opposed to the default trust store. My
> understanding is that a trust store does not require a private key. If I
> comment out adding the private key(signingPrivateKey), the test fails.
> Either my understanding of the test is wrong, or I am missing something by
> a long shot. Hope I put my confusion clearly.
>
> 2. In my implementation for establishing trust, I am running into an
> exception(pasted at the bottom for legibility). I found this related
> discussion from 2013
> <http://comments.gmane.org/gmane.comp.web.shibboleth.devel/4222>. By any
> chance, have you come across the root cause for this? I debugged through
> the error and found that the failure is at
> org.apache.commons.ssl.KeyStoreBuilder.parse(byte[], char[], char[]) of
> the  not-yet-commons-ssl library. Apparently, it was not able to return a
> BuildResult object and throws the exception at the end.
>
> Thank you for your patience and help.
>
> Regards,
> Sundeep
>
> Exception stack trace:
>
> org.opensaml.xml.security.SecurityException: Error extracting certificates
> from X509Data
>     at
> org.opensaml.xml.security.keyinfo.provider.InlineX509DataProvider.extractCertificates(InlineX509DataProvider.java:195)
>     at
> org.opensaml.xml.security.keyinfo.provider.InlineX509DataProvider.process(InlineX509DataProvider.java:126)
>     at
> org.opensaml.xml.security.keyinfo.BasicProviderKeyInfoCredentialResolver.processKeyInfoChild(BasicProviderKeyInfoCredentialResolver.java:300)
>     at
> org.opensaml.xml.security.keyinfo.BasicProviderKeyInfoCredentialResolver.processKeyInfoChildren(BasicProviderKeyInfoCredentialResolver.java:256)
>     at
> org.opensaml.xml.security.keyinfo.BasicProviderKeyInfoCredentialResolver.processKeyInfo(BasicProviderKeyInfoCredentialResolver.java:190)
>     at
> org.opensaml.xml.security.keyinfo.BasicProviderKeyInfoCredentialResolver.resolveFromSource(BasicProviderKeyInfoCredentialResolver.java:149)
>     at
> org.opensaml.xml.security.credential.AbstractCriteriaFilteringCredentialResolver.resolve(AbstractCriteriaFilteringCredentialResolver.java:57)
>     at
> org.opensaml.xml.security.credential.AbstractCriteriaFilteringCredentialResolver.resolve(AbstractCriteriaFilteringCredentialResolver.java:37)
>     at
> org.opensaml.xml.signature.impl.BaseSignatureTrustEngine.validate(BaseSignatureTrustEngine.java:99)
>     at
> org.opensaml.xml.signature.impl.ExplicitKeySignatureTrustEngine.validate(ExplicitKeySignatureTrustEngine.java:100)
>     //.. Lines omitted
> Caused by: java.security.cert.CertificateException: Unable to decode X.509
> certificates
>     at
> org.opensaml.xml.security.x509.X509Util.decodeCertificate(X509Util.java:362)
>     at
> org.opensaml.xml.security.keyinfo.KeyInfoHelper.getCertificate(KeyInfoHelper.java:201)
>     at
> org.opensaml.xml.security.keyinfo.KeyInfoHelper.getCertificates(KeyInfoHelper.java:176)
>     at
> org.opensaml.xml.security.keyinfo.provider.InlineX509DataProvider.extractCertificates(InlineX509DataProvider.java:192)
>     ... 34 more
> Caused by: java.security.KeyStoreException: failed to extract any
> certificates or private keys - maybe bad password?
>     at
> org.apache.commons.ssl.KeyStoreBuilder.parse(KeyStoreBuilder.java:443)
>     at org.apache.commons.ssl.TrustMaterial.<init>(TrustMaterial.java:213)
>     at org.apache.commons.ssl.TrustMaterial.<init>(TrustMaterial.java:165)
>     at
> org.opensaml.xml.security.x509.X509Util.decodeCertificate(X509Util.java:359)
>     ... 37 more
>
>
> On Mon, Dec 15, 2014 at 9:24 PM, Brent Putman <putmanb at georgetown.edu>
> wrote:
>
>>
>> On 12/15/14 2:51 PM, Sandy wrote:
>>
>>   Thank you Brent.
>>
>>  The SP is built with OpenSAML Java(2.6.3). Like you correctly guessed,
>> at the moment I am looking to resolve a Credential from KeyInfo.
>>
>>
>> We have a KeyInfoCredentialResolver exactly for that purpose.  That's an
>> interface.  For the signature validation processing case, the main impl to
>> look at is:
>> org.opensaml.xml.security.keyinfo.BasicProviderKeyInfoCredentialResolver.
>>
>> You can get a basic instance of that with the typical providers already
>> wired in (suitable for your use case) from:
>>
>> Configuration.getGlobalSecurityConfiguration().getDefaultKeyInfoCredentialResolver()
>>
>> The unit tests should give you usage examples.
>>
>>
>>
>>
>>  Thank you for the advise on establishing trust. I now understand how
>> important it is and I would implement it. The more complex example at the
>> bottom serves as a great resource for this.
>>
>>
>> That example illustrates the trust establishment using SAML metadata, b/c
>> that is the trusted CredentialResolver that is specified.  If you wanted to
>> use a different source of trusted Credentials for the
>> ExplicitKeySignatureTrustEngine, you would just swap out the metadata-based
>> one for a different one.  There are several CredentialResolver impls.
>>
>>
>>  If there happen to be examples citing the usage of credential resolvers
>> and a basic signature trust engine, it would be great to know them. I plan
>> on using a local trust store at the SP for establishing the trust.
>>
>>
>> Well, that example in the wiki is pretty complete, as far as just using
>> the trust engine.  Other than that, there's just unit tests and the
>> Shibboleth IdP, which is built on top of all of this.  I don't know what
>> exactly you want to know, but if you have specific questions, just post
>> them here.
>>
>> --Brent
>>
>>
>> --
>> To unsubscribe from this list send an email to
>> dev-unsubscribe at shibboleth.net
>>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/dev/attachments/20141218/d778c890/attachment.html