Odd behavior when signing SAML 1.1 Assertion w/ Advice

[Stephen.CTR.Chappell at faa.gov]

Thank you, Scott. The actual signature is applied elsewhere, I missed that when I originally posted. But removing the releaseDOM() calls does result in a properly signed SAML Assertion. That bit of code came out of the WSS4J libraries, and they have some (unidentified) downstream issues if they don't drop the DOM there. I'm having downstream issues too, but I haven't tracked them down completely yet. I'm working with a large, complex set of legacy code so I suppose that's not surprising.

Thanx again,

Stephen W. Chappell


-----Original Message-----
From: dev-bounces at shibboleth.net [mailto:dev-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Thursday, October 09, 2014 10:25 AM
To: Shib Dev
Subject: Re: Odd behavior when signing SAML 1.1 Assertion w/ Advice

On 10/9/14, 8:00 AM, "Stephen.CTR.Chappell at faa.gov"
<Stephen.CTR.Chappell at faa.gov> wrote:

> 
>The code I¹m using to sign the assertion is based heavily on the WSS4J 
>AssertionWrapper signAssertion code. Here it is:

I don't see anything there that actually signs the assertion, but that aside, and notwithstanding that I don't really know the Java well enough to comment, it looks questionable to me that you're dropping the DOM at the end, because I don't recall the Java code ever having full round trip fidelity when the DOM isn't cached, particularly when signatures are involved.

-- Scott

--
To unsubscribe from this list send an email to dev-unsubscribe at shibboleth.net