Can you help me successfully validate the signature of an assertion?

[Brent Putman]

On 6/3/15 11:28 AM, Richard Mundell wrote:
>
>  
>
> The code is here: http://pastebin.com/vkNVGEXW
>
>  
>
> 2) unmarshalls the assertion response from a String into an OpenSAML
> Assertion object
>

The Assertion string you have there looks suspciously
indented/pretty-printed...  I don't think TestShib generates Assertions
formatted like that.  And since you're pulling it in as a string, and
having to escape things, etc, almost certainly there's some error in
there, such that it's not the same XML that was signed.

>  
>
> Unfortunately this final step doesn't work and I get a “Invalid
> signature due to this error: Signature did not validate against the
> credential's key” exception.
>

Assuming you're sure you have the right validation key, I'd wager with
99.9% certainty that you have corrupted the Assertion by modifying it
from what was signed.  Adding/removing even a single character of
whitespace will invalidate the signature.

In case you haven't found yet:

https://wiki.shibboleth.net/confluence/display/OpenSAML/OSTwoUserManJavaDSIG

and in particular:

https://wiki.shibboleth.net/confluence/display/OpenSAML/OSTwoUserManSigErrors


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20150603/dd4cfc67/attachment.html>