OpenSAML Signing

[Brent Putman]

On 11/6/15 11:25 AM, Phil Lello wrote:
> I now have this working; there were two things to change:
>
>

Glad to hear it.
> This correctly adds the DS:X509 section to the generated XML
>

Sending that is optional for a signature.  If you're testing with a
Shibboleth IdP, that won't make any difference as to the IdP's ability
to validate the signature.  It's just advisory.


> - Adding metadata for the SP to the IdP (I haven't written my
> Metadata export yet, but had expected signed requests to be treated
> the same way as unsigned ones at the IdP, rather than throwing (IMHO)
> a misleading "org.opensaml.messaging.handler.MessageHandlerException:
> Validation of protocol message signature failed" when the message is
> intact but the IdP lacks metadata.
>

Having the SP's signing cert in the SP metadata held by the IdP is
absolutely mandatory.  Trust (e.g signature validation) in Shibboleth
is based on metadata, period.


> Everything now looks good, although I'm not convinced that there
> aren't higher level functions I should be using.
>


Indeed, there are lots of higher level components that would greatly
simplify some of what you posted originally, esp around loading and
using Credentials and the output of the message to the binding.  I'm
swamped at the moment with the 3.2 release, but a combination of
looking at the user's manual [1], the library's unit tests and the IdP
would be a good place to research.

One note however: it looks like you are using OpenSAML v2.  That will
be officially unsupported as of middle of next year, along with the IdP
v2.  If you are starting a new project with OpenSAML, I'd highly
recommend you use OpenSAML v3. Most of what you already know is
directly applicable.  There have been some changes in package names and
some class names, but most of the library works the same way (the big
exception being the messaging layer for encoding, decoding and handling
protocol messages, which it doesn't appear you are using yet anyway). 
Again, looking at unit tests and some of the IdP code is probably the
best resource at this point.


[1]
https://wiki.shibboleth.net/confluence/display/OpenSAML/OSTwoUserManual 
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20151106/1e5a76c4/attachment.html>