OpenSAML Signing

[Phil Lello]

Hi all,

I've been trying to write an SP implementation, first with core Java, and
now with OpenSAML after I hit a roadblock. Unfortunately, I'm getting stuck
in the same place; I can sign assertions, but the signatures are invalid.

My current code is as follows:

                AuthnRequestBuilder rb = new AuthnRequestBuilder();
                AuthnRequest r = rb.buildObject();
                IssuerBuilder ib = new IssuerBuilder();
                Issuer i = ib.buildObject();
                i.setValue(this.url);
                r.setIssuer(i);
                r.setIssueInstant(new DateTime());
                r.setID(generateId());
                r.setAssertionConsumerServiceURL(url+"sp/acs");
                r.setDestination(IdP);

r.setProtocolBinding("urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST");
                NameIDPolicyBuilder nb = new NameIDPolicyBuilder();
                NameIDPolicy nameIDPolicy = nb.buildObject();
                nameIDPolicy.setAllowCreate(true);

nameIDPolicy.setFormat("urn:oasis:names:tc:SAML:2.0:nameid-format:persistent");
                r.setNameIDPolicy(nameIDPolicy);

                BasicX509Credential credential = new BasicX509Credential();
                JcaPEMKeyConverter kc = new
JcaPEMKeyConverter().setProvider("BC");
                credential.setEntityCertificate(getCertificate());

credential.setPrivateKey(kc.getPrivateKey(getPrivateKeyInfo()));
                KeyInfoGeneratorFactory kigf = new
X509KeyInfoGeneratorFactory();
                KeyInfo ki = kigf.newInstance().generate(credential);

                Signature signature =
(Signature)Configuration.getBuilderFactory().getBuilder(Signature.
DEFAULT_ELEMENT_NAME).buildObject(Signature.DEFAULT_ELEMENT_NAME);
                signature.setSigningCredential(credential);

signature.setSignatureAlgorithm(SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA1);

signature.setCanonicalizationAlgorithm(SignatureConstants.ALGO_ID_C14N_EXCL_OMIT_COMMENTS);
                signature.setKeyInfo(ki);
                r.setSignature(signature);

Configuration.getMarshallerFactory().getMarshaller(r).marshall(r);
                Signer.signObject(signature);

                MarshallerFactory mf = Configuration.getMarshallerFactory();
                Marshaller m = mf.getMarshaller(r);

                DOMSource source = new DOMSource(m.marshall(r));
                TransformerFactory tf = TransformerFactory.newInstance();
                Transformer t = tf.newTransformer();
                StringWriter sw = new StringWriter();
                StreamResult result = new StreamResult(sw);
                t.transform(source, result);
                byte[] encodedBytes =
Base64.encodeBase64(sw.toString().getBytes());

And the certificate/key reading functions are:

    protected X509Certificate getCertificate() throws IOException,
CertificateException
    {
        Path x509crtfile = dataDir.resolve("cert.pem");
        PEMParser pem = new PEMParser(Files.newBufferedReader(x509crtfile,
Charset.forName("UTF8")));
        return new
JcaX509CertificateConverter().setProvider("BC").getCertificate((X509CertificateHolder)pem.
readObject());
    }

    protected PrivateKeyInfo getPrivateKeyInfo() throws IOException,
NoSuchAlgorithmException,                InvalidKeySpecException
    {

        Path x509keyfile = dataDir.resolve("key.pem");
        Security.addProvider(new BouncyCastleProvider());
        PEMParser pem = new PEMParser(Files.newBufferedReader(x509keyfile,
Charset.forName("UTF8")));
        return (PrivateKeyInfo)pem.readObject();
    }

Any pointers on where I'm going wrong, or perhaps a reference to a working
signed AuthnRequest example greatly appreciated.

The cert/key were generated by "openssl req -x509 -newkey rsa:2048 -keyout
key.pem -out cert.pem -days 3650 -nodes"; I can share the files if it will
help.

Phil
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20151106/dfcf3baa/attachment-0001.html>