Retrieve the digest algorithm(s) used in an Assertion

[Stephen.CTR.Chappell at faa.gov]

I have a requirement to validate that the digest algorithm used in an Assertion's signature conforms with our profile, but I'm having some trouble retrieving the digest algorithm that was used using OpenSaml 2.6. To start, I have a org.opensaml.saml2.core.Assertion built from a SOAPElement. After validating the signature, I am trying to do further validations. I had thought that iterating over the ContentReference list in the org.opensaml.xml.signature.Signature would let me validate the digest algorithms, if the references were cast to a SAMLObjectContentReference, like so:

                                List<ContentReference> contentRefs = signature.getContentReferences();
                                for ( int i = 0 ; i < contentRefs.size() ; i++ ) {
                                                ContentReference ref = contentRefs.get(i);
                                                String detectedDigestAlgo = "";

                                                if ( ref instanceof SAMLObjectContentReference ) {
                                                                detectedDigestAlgo = ((SAMLObjectContentReference)ref).getDigestAlgorithm();
                                                }
                if ( !MessageDigestAlgorithm.ALGO_ID_DIGEST_SHA256.equals(detectedDigestAlgo) )
                                                {
                                                                // do stuff
                                                }
                                }

While it seems that the content references are initialized (the transforms appear to be correct, the signableObject points to the Assertion, etc), the digestAlgorithm is set to a default value (http://www.w3.org/2000/09/xmldsig#sha1", which is not what is used in the Assertion.

Is there a way to retrieve the actual digest method that was used? I could just parse the original SOAPElement, but if there is an OpenSAML-ish way to go about it that would be helpful.

Thanx,

Stephen W. Chappell
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/dev/attachments/20141229/36be6477/attachment.html