Can you help me successfully validate the signature of an assertion?

[Richard Mundell]

Brent - yes, that was it. When I'd copy/pasted the XML the tabs/indentation ended up slightly different. We'd assumed that the formatting (tabs, carriage returns, etc) of the XML wasn't important. After all, the signature is being checked against a Document object hierarchy rather than the String representation, and it's not an unreasonable assumption that none of the formatting gets carried over into the object representation. But it seems this does make a difference. Once I'd corrected it, it happily validated. Really appreciate your assistance! Thanks, Richard


From: dev [mailto:dev-bounces at shibboleth.net] On Behalf Of Brent Putman
Sent: 03 June 2015 20:00
To: dev at shibboleth.net
Subject: Re: Can you help me successfully validate the signature of an assertion?


On 6/3/15 11:28 AM, Richard Mundell wrote:

The code is here: http://pastebin.com/vkNVGEXW

2) unmarshalls the assertion response from a String into an OpenSAML Assertion object

The Assertion string you have there looks suspciously indented/pretty-printed...  I don't think TestShib generates Assertions formatted like that.  And since you're pulling it in as a string, and having to escape things, etc, almost certainly there's some error in there, such that it's not the same XML that was signed.



Unfortunately this final step doesn't work and I get a "Invalid signature due to this error: Signature did not validate against the credential's key" exception.

Assuming you're sure you have the right validation key, I'd wager with 99.9% certainty that you have corrupted the Assertion by modifying it from what was signed.  Adding/removing even a single character of whitespace will invalidate the signature.

In case you haven't found yet:

https://wiki.shibboleth.net/confluence/display/OpenSAML/OSTwoUserManJavaDSIG

and in particular:

https://wiki.shibboleth.net/confluence/display/OpenSAML/OSTwoUserManSigErrors

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20150604/e56fade3/attachment.html>