Retrieve the digest algorithm(s) used in an Assertion

[Brent Putman]

On 12/29/14 2:48 PM, Stephen.CTR.Chappell at faa.gov wrote:
>
> I had thought that iterating over the ContentReference list in the
> org.opensaml.xml.signature.Signature would let me validate the digest
> algorithms, if the references were cast to a
> SAMLObjectContentReference, like so:
>
>  
>

No, unfortunately not.  In both v2 and v3 since most of the signature
support is based on Apache Santuario, we don't really fully unmarshall
the original DOM Element data to Java objects.  The Signature XMLObject
impl is kind of the oddball of all our XMLObject provider impls.



>  
>
> While it seems that the content references are initialized (the
> transforms appear to be correct, the signableObject points to the
> Assertion, etc), the digestAlgorithm is set to a default value
> (http://www.w3.org/2000/09/xmldsig#sha1”, which is not what is used in
> the Assertion.
>

I actually think in both cases you're just seeing the content reference
defaults.  The transform ones just happen to be correct for your example
data.  I don't think we do anything to populate those on unmarshalling,
as I said above.


>  
>
> Is there a way to retrieve the actual digest method that was used? I
> could just parse the original SOAPElement, but if there is an
> OpenSAML-ish way to go about it that would be helpful.
>


In v3 we actually have a new similar feature, in that we support an
algorithm whitelist/blacklist eval.  For that, we just evaluate the
Signature DOM Element directly:

http://svn.shibboleth.net/view/java-opensaml/trunk/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/support/impl/SignatureAlgorithmValidator.java?revision=3984&view=markup


-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/dev/attachments/20141229/244ab18c/attachment.html