Opensaml 2.6.0 : Validating signature of a Response

[Brent Putman]

On 1/24/14 9:17 AM, Yann Bourdeau wrote:
> Hi!
>
> I have a hard time figuring out how to validate the signature of a
> response for SSO. From what i have found on the net and the
> documentation i need to use a TrustEngine and a File MetaData Provider
> that will contains the the x.509 certificate to validate agains it.


If you haven't found it yet, the OpenSAML user guide for signatures is here:

https://wiki.shibboleth.net/confluence/display/OpenSAML/OSTwoUserManJavaDSIG

It has a pretty good example for this.



> Each time, that i try to initialize the Mete Data Provider, i got a
> Java.lang.NullPointerException (Later Unable to marshall metadata).


I think you're actual problem is not related to signature components
itself.  I think that NPE is happening because you haven't supplied a
parser pool to the metadata provider.  I don't see your code below doing
that and based on line numbers in the exception that's what I suspect. 
That is a required property on the metadata provider. 



>
> Anyway here is my code:
> String responseMessage =
> getContext().getRequest().getParameter("SAMLResponse").toString(); 
>      
> DocumentBuilderFactory documentBuilderFactory =
> DocumentBuilderFactory.newInstance();
> documentBuilderFactory.setNamespaceAware(true);
> DocumentBuilder docBuilder = documentBuilderFactory.newDocumentBuilder();
>         byte[] encodedRequestMessage = Base64.decode( responseMessage );
> ByteArrayInputStream is=new ByteArrayInputStream(new
> String(encodedRequestMessage, "UTF-8").getBytes());
> Document document = docBuilder.parse(is);
> Element element = document.getDocumentElement();
> UnmarshallerFactory unmarshallerFactory =
> Configuration.getUnmarshallerFactory();
> Unmarshaller unmarshaller = unmarshallerFactory.getUnmarshaller(element);
> Response response = (Response) unmarshaller.unmarshall(element);

Btw, the real way to do the above is using a MessageDecoder, which
implements the SAML binding in use.  It encapsulates all of the above. 
We don't have any good official docs on that, but someone has an example
that at least illustrates the idea:

https://wiki.shibboleth.net/confluence/display/OpenSAML/OSTwoUserManualPsedocodeSP

Or you can look at the decoder unit tests for examples.




>         // INIT ONCE
>         FilesystemMetadataProvider idpMetaDataProvider = new
> FilesystemMetadataProvider(new
> File("/Volumes/Éléphant/apache/apache-tomcat-7.0.47/webapps/panelo/WEB-INF/classes/opensamlmetadata.xml"));
>  
> idpMetaDataProvider.initialize();

Yeah, you need to supply a ParserPool instance before you init the provider.



-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/dev/attachments/20140124/42debbe8/attachment.html