ADFS :Opensaml2 Integration: Signature did not validate against the credential's key
smita.sree2007 at gmail.com
smita.sree2007 at gmail.com
Fri Feb 14 07:42:34 EST 2014
Hi,
We had implemented SP initiated SAML2 using opensaml 2.2.3 . All our IDP
were using self signed certificates and these work well .
Now we have an IDP configured via ADFS, response from which is getting
failed at our server ,with below error.
org.opensaml.xml.validation.ValidationException: Signature did not validate
against the credential's key.
-Digest value is same in both incoming response assertion and in opensaml
debug log
-Same integration works fine if we try with a keytool generated selfsigned
certificate.
Details of IPD certificate:
------------------------
-IDP uses ADFS token signing certificate to sign the response
-IDP provided their communication certificate which is uploaded in our
server
-For IDP certificate, publick key is RSA(2048 bits)
-Signature algorithm for the certificate is sha256RSA
-Signature hash algorithm is sha256
-Thumb print algorithm is sha1
Any help would be much appreciated.
We use open saml api as below:
<code>
X509Certificate entityCert =
getCertificate(certificatePath);
BasicX509Credential cred = new BasicX509Credential();
cred.setEntityCertificate(entityCert);
cred.setPublicKey(entityCert.getPublicKey());
SAMLSignatureProfileValidator profileValidator = new
SAMLSignatureProfileValidator();
try
{
profileValidator.validate(rsp.getSignature());
}
catch (ValidationException e)
{
log.error(e);
}
SignatureValidator validator = new SignatureValidator(cred);
validator.validate(response.getSignature());
</code>
Log:
---------
2014-02-14 16:49:48,454 DEBUG [org.apache.xml.security.utils.ElementProxy]
(http-127.0.0.1-443-5) setElement("ds:Reference", "")
2014-02-14 16:49:48,455 DEBUG [org.apache.xml.security.utils.ElementProxy]
(http-127.0.0.1-443-5) setElement("ds:Transforms", "")
2014-02-14 16:49:48,456 DEBUG [org.apache.xml.security.utils.IdResolver]
(http-127.0.0.1-443-5) getElementByIdType() Search for ID
_be751b24-85ad-4197-a171-eb8432a0fcbe
2014-02-14 16:49:48,457 DEBUG [org.apache.xml.security.utils.IdResolver]
(http-127.0.0.1-443-5) getElementByIdUsingDOM() Search for ID
_be751b24-85ad-4197-a171-eb8432a0fcbe
2014-02-14 16:49:48,465 DEBUG [org.apache.xml.security.utils.IdResolver]
(http-127.0.0.1-443-5) I could find an Element using the simple
getElementByIdUsingDOM method: samlp:Response
2014-02-14 16:49:48,466 DEBUG [org.apache.xml.security.utils.ElementProxy]
(http-127.0.0.1-443-5) setElement("ds:Transform", "")
2014-02-14 16:49:48,466 DEBUG
[org.opensaml.security.SAMLSignatureProfileValidator] (http-127.0.0.1-443-5)
Saw Enveloped signature transform
2014-02-14 16:49:48,467 DEBUG [org.apache.xml.security.utils.ElementProxy]
(http-127.0.0.1-443-5) setElement("ds:Transform", "")
2014-02-14 16:49:48,467 DEBUG
[org.opensaml.security.SAMLSignatureProfileValidator] (http-127.0.0.1-443-5)
Saw Exclusive C14N signature transform
2014-02-14 16:49:48,840 DEBUG
[org.opensaml.xml.signature.SignatureValidator] (http-127.0.0.1-443-5)
Attempting to validate signature using key from supplied credential
2014-02-14 16:49:48,841 DEBUG
[org.opensaml.xml.signature.SignatureValidator] (http-127.0.0.1-443-5)
Creating XMLSignature object
2014-02-14 16:49:48,842 DEBUG
[org.opensaml.xml.signature.SignatureValidator] (http-127.0.0.1-443-5)
Validating signature with signature algorithm URI:
http://www.w3.org/2000/09/xmldsig#rsa-sha1
2014-02-14 16:49:48,842 DEBUG
[org.opensaml.xml.signature.SignatureValidator] (http-127.0.0.1-443-5)
Validation credential key algorithm 'RSA', key instance class
'sun.security.rsa.RSAPublicKeyImpl'
2014-02-14 16:49:48,843 DEBUG
[org.apache.xml.security.signature.XMLSignature] (http-127.0.0.1-443-5)
SignatureMethodURI = http://www.w3.org/2000/09/xmldsig#rsa-sha1
2014-02-14 16:49:48,844 DEBUG
[org.apache.xml.security.signature.XMLSignature] (http-127.0.0.1-443-5)
jceSigAlgorithm = SHA1withRSA
2014-02-14 16:49:48,845 DEBUG
[org.apache.xml.security.signature.XMLSignature] (http-127.0.0.1-443-5)
jceSigProvider = SunRsaSign
2014-02-14 16:49:48,852 DEBUG
[org.apache.xml.security.signature.XMLSignature] (http-127.0.0.1-443-5)
PublicKey = Sun RSA public key, 2048 bits
modulus:
21573385589254565865637448458035177630286245241516662673835353753011201752705125908861744967907398755592646627644229838496263948501562563232203924158578854648261505632138429666958385957247735794518466865021640191324603339889207890431905663126829012077464303202949307304049338221478167267683177709837358038185480259240358967789687417814516703492621304177657871976837799996804960371336475560367577489208671587383947951932750014480058865306980908723096435852115069337818857554397775867023004228725822621308308814290244370198744318298802581240777256716323326742955906560436842673655950322658458792517840117594280286368533
public exponent: 65537
2014-02-14 16:49:48,858 DEBUG
[org.apache.xml.security.utils.SignerOutputStream] (http-127.0.0.1-443-5)
Canonicalized SignedInfo:
2014-02-14 16:49:48,860 DEBUG
[org.apache.xml.security.utils.SignerOutputStream] (http-127.0.0.1-443-5)
<ds:SignedInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
<ds:CanonicalizationMethod
Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"></ds:CanonicalizationMethod>
<ds:SignatureMethod
Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"></ds:SignatureMethod>
<ds:Reference URI="#_be751b24-85ad-4197-a171-eb8432a0fcbe">
<ds:Transforms>
<ds:Transform
Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"></ds:Transform>
<ds:Transform
Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"></ds:Transform>
</ds:Transforms>
<ds:DigestMethod
Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"></ds:DigestMethod>
<ds:DigestValue>l2xB91P/LSPpMDAxXE0TyTayu2o=</ds:DigestValue>
</ds:Reference>
</ds:SignedInfo>
2014-02-14 16:49:48,874 WARN
[org.apache.xml.security.signature.XMLSignature] (http-127.0.0.1-443-5)
Signature verification failed.
2014-02-14 16:49:48,875 DEBUG
[org.opensaml.xml.signature.SignatureValidator] (http-127.0.0.1-443-5)
Signature did not validate against the credential's key
org.opensaml.xml.validation.ValidationException: Signature did not validate
against the credential's key
at
org.opensaml.xml.signature.SignatureValidator.validate(SignatureValidator.java:79)
--
View this message in context: http://shibboleth.1660669.n2.nabble.com/ADFS-Opensaml2-Integration-Signature-did-not-validate-against-the-credential-s-key-tp7595247.html
Sent from the Shibboleth - Developers mailing list archive at Nabble.com.
More information about the dev
mailing list