Retrieve the digest algorithm(s) used in an Assertion

[Stephen.CTR.Chappell at faa.gov]

Well, that's unfortunate; I'll have to crack it out of the SOAPElement then. Thanx!

Stephen W. Chappell

From: dev-bounces at shibboleth.net [mailto:dev-bounces at shibboleth.net] On Behalf Of Brent Putman
Sent: Monday, December 29, 2014 4:15 PM
To: dev at shibboleth.net
Subject: Re: Retrieve the digest algorithm(s) used in an Assertion


On 12/29/14 2:48 PM, Stephen.CTR.Chappell at faa.gov<mailto:Stephen.CTR.Chappell at faa.gov> wrote:
I had thought that iterating over the ContentReference list in the org.opensaml.xml.signature.Signature would let me validate the digest algorithms, if the references were cast to a SAMLObjectContentReference, like so:


No, unfortunately not.  In both v2 and v3 since most of the signature support is based on Apache Santuario, we don't really fully unmarshall the original DOM Element data to Java objects.  The Signature XMLObject impl is kind of the oddball of all our XMLObject provider impls.





While it seems that the content references are initialized (the transforms appear to be correct, the signableObject points to the Assertion, etc), the digestAlgorithm is set to a default value (http://www.w3.org/2000/09/xmldsig#sha1", which is not what is used in the Assertion.

I actually think in both cases you're just seeing the content reference defaults.  The transform ones just happen to be correct for your example data.  I don't think we do anything to populate those on unmarshalling, as I said above.




Is there a way to retrieve the actual digest method that was used? I could just parse the original SOAPElement, but if there is an OpenSAML-ish way to go about it that would be helpful.


In v3 we actually have a new similar feature, in that we support an algorithm whitelist/blacklist eval.  For that, we just evaluate the Signature DOM Element directly:

http://svn.shibboleth.net/view/java-opensaml/trunk/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/support/impl/SignatureAlgorithmValidator.java?revision=3984&view=markup

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/dev/attachments/20141230/596ccb66/attachment-0001.html