Can you help me successfully validate the signature of an assertion?

[Richard Mundell]

Hello there,

I'm attempting to create a proof of concept for being a service provider for SAML2 authentication for one of my clients (who will be the IdP).

I've gotten as far as creating a SAML request to an IdP (which works great), and receiving the assertion response back.

Unfortunately I'm falling at the last hurdle - validating the signature of the assertion.

I've created a very simple standalone JSP to illustrate the problem (yes - I know this shouldn't all be in a JSP, but it's only for a proof of concept!).

The code is here: http://pastebin.com/vkNVGEXW and the assertion here: http://pastebin.com/9iPFXRiU.

This JSP does the following things:

1) bootstraps OpenSAML
2) unmarshalls the assertion response from a String into an OpenSAML Assertion object
3) converts the IdP's signing certificate from base64 into an X509Certificate object and extracts the public key
4) uses OpenSAML's SignatureValidator to validate the signature with the key

Unfortunately this final step doesn't work and I get a "Invalid signature due to this error: Signature did not validate against the credential's key" exception.

Included in the JSP is a sample assertion generated from testshib.org and their certificate. (I don't believe it's a problem with testshib.org though because I get exactly the same problem with signed assertions from other sources too).

Many thanks, in advance, for any tips you can give!

Richard
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20150603/c09b7dc4/attachment.html>