Mashaling signed assertion causes assertion signature validation to fail

[Gang Yang]

Some updates on this problem.

By not setting the ID on the assertion, which let the signing code do it,
it fixed the marshaling breaking the signature problem.

However, signing the enclosing Response breaks the assertion's signature
again with "Signature did not validate against the credential's key" error.

All the above problem occur on the sender side, which creates and signs the
assertion. Even if I remove the response signing, the receiver side still
fails to validate the assertion signature with the same error as that
caused by signing the response.

It seemed the signature is vary fragile. Even the seemed "read-only"
operations can break it.

Gang

On Fri, Jul 17, 2015 at 3:55 PM, Gang Yang <gang.yang at shonborn-becker.com>
wrote:

> Hi,
>
>
>
> I'm using OpenSAML 2.5.1-1. When I construct an assertion, sign it and
> validate the signature, it all works. However, if I print the assertion by
> marshaling it to Element and then String before I validate the signature,
> it causes the signature validation to fail with the following exception:
>
>
>
> *org.opensaml.xml.validation.ValidationException*
> : Apache xmlsec IdResolver could not resolve the Element for id reference:
> abcd
>
>
>
> I check the source code history of the code dated back two years ago, it's
> the same. I do believe it worked then otherwise I would not have checked
> in. Has anyone seen similar problem? Can someone provide some pointers and
> suggestions on this issue?
>
>
>
> Thanks in advance.
>
>
>
> Gang
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20150717/bb00ad35/attachment.html>