Opensaml 2.6.0 : Validating signature of a Response

[Yann Bourdeau]

Thanks Brent. Now it goes farther(invalid or not trusted signature). I will try to figure why it does not works.

Le 2014-01-24 à 16:49, Brent Putman <putmanb at georgetown.edu> a écrit :

> 
> On 1/24/14 9:17 AM, Yann Bourdeau wrote:
>> Hi!
>> 
>>  I have a hard time figuring out how to validate the signature of a response for SSO. From what i have found on the net and the documentation i need to use a TrustEngine and a File MetaData Provider that will contains the the x.509 certificate to validate agains it.
> 
> 
> If you haven't found it yet, the OpenSAML user guide for signatures is here:
> 
> https://wiki.shibboleth.net/confluence/display/OpenSAML/OSTwoUserManJavaDSIG
> 
> It has a pretty good example for this.
> 
> 
> 
>> Each time, that i try to initialize the Mete Data Provider, i got a Java.lang.NullPointerException (Later Unable to marshall metadata).
> 
> 
> I think you're actual problem is not related to signature components itself.  I think that NPE is happening because you haven't supplied a parser pool to the metadata provider.  I don't see your code below doing that and based on line numbers in the exception that's what I suspect.  That is a required property on the metadata provider.  
> 
> 
> 
>> 
>> Anyway here is my code:
>> String responseMessage = getContext().getRequest().getParameter("SAMLResponse").toString(); 
>>      
>>  DocumentBuilderFactory documentBuilderFactory = DocumentBuilderFactory.newInstance();
>>  documentBuilderFactory.setNamespaceAware(true);
>>  DocumentBuilder docBuilder = documentBuilderFactory.newDocumentBuilder();
>>  
>>         byte[] encodedRequestMessage = Base64.decode( responseMessage );
>>  
>>  ByteArrayInputStream is=new ByteArrayInputStream(new String(encodedRequestMessage, "UTF-8").getBytes());
>>  Document document = docBuilder.parse(is);
>>  Element element = document.getDocumentElement();
>>  UnmarshallerFactory unmarshallerFactory = Configuration.getUnmarshallerFactory();
>>  Unmarshaller unmarshaller = unmarshallerFactory.getUnmarshaller(element);
>>  Response response = (Response) unmarshaller.unmarshall(element);
>>  
> 
> Btw, the real way to do the above is using a MessageDecoder, which implements the SAML binding in use.  It encapsulates all of the above.  We don't have any good official docs on that, but someone has an example that at least illustrates the idea:
> 
> https://wiki.shibboleth.net/confluence/display/OpenSAML/OSTwoUserManualPsedocodeSP
> 
> Or you can look at the decoder unit tests for examples.
> 
> 
> 
> 
>>         // INIT ONCE
>>         FilesystemMetadataProvider idpMetaDataProvider = new FilesystemMetadataProvider(new File("/Volumes/Éléphant/apache/apache-tomcat-7.0.47/webapps/panelo/WEB-INF/classes/opensamlmetadata.xml"));  
>>  idpMetaDataProvider.initialize();
> 
> Yeah, you need to supply a ParserPool instance before you init the provider.
> 
> 
> 
> --
> To unsubscribe from this list send an email to dev-unsubscribe at shibboleth.net


-- 


CONFIDENTIALITY: This e-mail message (including attachments, if any) is 
confidential and is intended only for the addressee. Any unauthorized use 
or disclosure is strictly prohibited. Disclosure of this e-mail to anyone 
other than the intended addressee does not constitute waiver of privilege. 
If you have received this communication in error, please notify us 
immediately and delete this. Thank you for your cooperation.  This message 
has not been encrypted.  Special arrangements can be made for encryption 
upon request.

CONFIDENTIALITÉ:  Ce message courriel (y compris les pièces jointes, le cas 
échéant) est confidentiel et destiné uniquement à la personne ou  à 
l'entité à qui il est adressé. Toute utilisation ou divulgation non permise 
est strictement interdite.  L'obligation de confidentialité et de secret 
professionnel demeure malgré toute divulgation.  Si vous avez reçu le 
présent courriel et ses annexes par erreur, veuillez nous en informer 
immédiatement et le détruire.  Nous vous remercions de votre 
collaboration.  Le présent message n'a pas été crypté.  Le cryptage est 
possible sur demande spéciale.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/dev/attachments/20140127/58c7897a/attachment-0001.html