Fwd: Re: algorithm agility

Tue Jan 13 21:00:04 EST 2015

Just reporting some (minor) success.  Managed to get my first 3.0.0 test
IdP up and running today, complete with LDAP authN and attribute
resolution. 

At Ian's request I was investigating/testing the support for algorithm
agility in metadata "for real" (not unit tests), and for me it just
worked as expected.  SP's metadata specified SHA-512 variants for
signing and digest, and that's what it did. 

I shouldn't be, but I'm still amazed sometimes when this stuff actually
works. :-)

--Brent

-------- Forwarded Message --------
Subject: 	Re: algorithm agility
Date: 	Tue, 13 Jan 2015 20:47:59 -0500
From: 	Brent Putman <putmanb at georgetown.edu>
To: 	Ian Young <ian at iay.org.uk>

On 1/13/15 3:05 PM, Brent Putman wrote:
>> I don't think there's much point in your spending time digging
>> further, unless you have a test framework you can just try it on.
>
> Coincidentally the last few days I've been boning up on Jetty 9.2.x
> and updating my test IdP 2.x VM (b/c it was ancient and vulnerable to
> POODLE).  Now that that's done, I was going to tackle standing up a
> 3.0.0 IdP for real.  Probably not today, but soon-ish.  So I may be in
> a position to investigate later this week.
>

The office was quiet today, so I did actually manage to get my first IdP
3.x stood up and working, with LDAP and everything (yay).  I did find a
bug in the first 5 seconds of running the installer, which didn't auger
well...

Anyway, I tried the algorithms in metadata for an SP, and for me it just
worked as expected.  The IdP out-of-the-box defaults to SHA-256
algorithms for signing, which I confirmed.  Then I put the SHA-512
variants in the SP's EntityDescriptor's Extensions:

<md:Extensions>
  <alg:SigningMethod
xmlns:alg="urn:oasis:names:tc:SAML:metadata:algsupport"
Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha512"></alg:SigningMethod>
  <alg:DigestMethod
xmlns:alg="urn:oasis:names:tc:SAML:metadata:algsupport"
Algorithm="http://www.w3.org/2001/04/xmlenc#sha512"></alg:DigestMethod>
</md:Extensions>

and I got the expected result on the response signature. Log details below.

To save you some time, this logback.xml snippet should give you some
good diagnostic info:

<logger
name="org.opensaml.saml.security.impl.SAMLMetadataSignatureSigningParametersResolver"
level="TRACE"/>
<logger
name="org.opensaml.xmlsec.impl.BasicSignatureSigningParametersResolver"
level="TRACE"/>
<logger
name="org.opensaml.saml.common.profile.impl.PopulateSignatureSigningParameters"
level="TRACE"/>

So I think you've got some local problem going on.  If you can't figure
it out, I can help you troubleshoot it if you give me some more info. 
But I think at least the simple basic algorithm agility capability using
metadata is working as expected.  It's possible of course that you're
triggering some bug that I'm not.

My log data:

2015-01-13 20:31:30,605 - DEBUG
[org.opensaml.saml.common.profile.impl.PopulateSignatureSigningParameters:184]
- Profile Action PopulateSignatureSigningParameters: Signing enabled
2015-01-13 20:31:30,606 - DEBUG
[org.opensaml.saml.common.profile.impl.PopulateSignatureSigningParameters:197]
- Profile Action PopulateSignatureSigningParameters: Resolving
SignatureSigningParameters for request
2015-01-13 20:31:30,607 - DEBUG
[org.opensaml.saml.common.profile.impl.PopulateSignatureSigningParameters:229]
- Profile Action PopulateSignatureSigningParameters: Adding metadata to
resolution criteria for signing/digest algorithms
2015-01-13 20:31:30,608 - TRACE
[org.opensaml.saml.security.impl.SAMLMetadataSignatureSigningParametersResolver:228]
- Resolved extensions from parent EntityDescriptor:
{urn:oasis:names:tc:SAML:metadata:algsupport}SigningMethod
2015-01-13 20:31:30,608 - TRACE
[org.opensaml.saml.security.impl.SAMLMetadataSignatureSigningParametersResolver:88]
- Evaluating SAML metadata SigningMethod with algorithm:
http://www.w3.org/2001/04/xmldsig-more#rsa-sha512, minKeySize: null,
maxKeySize: null
2015-01-13 20:31:30,610 - TRACE
[org.opensaml.saml.security.impl.SAMLMetadataSignatureSigningParametersResolver:101]
- Evaluating credential of type: RSA, with length: 2048
2015-01-13 20:31:30,611 - TRACE
[org.opensaml.saml.security.impl.SAMLMetadataSignatureSigningParametersResolver:107]
- Credential passed eval against SigningMethod
2015-01-13 20:31:30,611 - DEBUG
[org.opensaml.saml.security.impl.SAMLMetadataSignatureSigningParametersResolver:108]
- Resolved signature algorithm URI from SAML metadata SigningMethod:
http://www.w3.org/2001/04/xmldsig-more#rsa-sha512
2015-01-13 20:31:30,611 - TRACE
[org.opensaml.saml.security.impl.SAMLMetadataSignatureSigningParametersResolver:228]
- Resolved extensions from parent EntityDescriptor:
{urn:oasis:names:tc:SAML:metadata:algsupport}DigestMethod
2015-01-13 20:31:30,612 - TRACE
[org.opensaml.saml.security.impl.SAMLMetadataSignatureSigningParametersResolver:184]
- Evaluating SAML metadata DigestMethod with algorithm:
http://www.w3.org/2001/04/xmlenc#sha512
2015-01-13 20:31:30,612 - DEBUG
[org.opensaml.saml.security.impl.SAMLMetadataSignatureSigningParametersResolver:189]
- Resolved reference digest method algorithm URI from SAML metadata
DigestMethod: http://www.w3.org/2001/04/xmlenc#sha512
2015-01-13 20:31:30,619 - DEBUG
[org.opensaml.xmlsec.impl.BasicSignatureSigningParametersResolver:149] -
Resolved SignatureSigningParameters:
2015-01-13 20:31:30,620 - DEBUG
[org.opensaml.xmlsec.impl.BasicSignatureSigningParametersResolver:153] -
    Signing credential with key algorithm: RSA
2015-01-13 20:31:30,620 - DEBUG
[org.opensaml.xmlsec.impl.BasicSignatureSigningParametersResolver:158] -
    Signature algorithm URI:
http://www.w3.org/2001/04/xmldsig-more#rsa-sha512
2015-01-13 20:31:30,620 - DEBUG
[org.opensaml.xmlsec.impl.BasicSignatureSigningParametersResolver:160] -
    Signature KeyInfoGenerator: present
2015-01-13 20:31:30,620 - DEBUG
[org.opensaml.xmlsec.impl.BasicSignatureSigningParametersResolver:162] -
    Reference digest method algorithm URI:
http://www.w3.org/2001/04/xmlenc#sha512
2015-01-13 20:31:30,621 - DEBUG
[org.opensaml.xmlsec.impl.BasicSignatureSigningParametersResolver:163] -
    Canonicalization algorithm URI: http://www.w3.org/2001/10/xml-exc-c14n#
2015-01-13 20:31:30,621 - DEBUG
[org.opensaml.xmlsec.impl.BasicSignatureSigningParametersResolver:164] -
    HMAC output length: null
2015-01-13 20:31:30,621 - DEBUG
[org.opensaml.saml.common.profile.impl.PopulateSignatureSigningParameters:237]
- Profile Action PopulateSignatureSigningParameters: Resolved
SignatureSigningParameters

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/dev/attachments/20150113/f6b0f8df/attachment-0001.html 