[Non-DoD Source] RE: How to verify the message signature with HTTPRedirectDeflateDecoder?

Thu Apr 7 14:56:26 EDT 2016

Thank you, Scott, for the reply and the information. Here's a little more info on our project. We have been using OpenSAML for many years. Prior usage of OpenSAML has been in the SAML core area mainly using the SAML 1.1 and then SAML 2.0 object constructs. We developed our own binding and profile for both SP and IdP sides using SAML 2.0 Post binding. The trust model is PKIX (static according to your article). Now a new requirement is added for Redirect binding. I would like to use OpenSAML all the way, but our existing code does not allow me to easily. I would still like to use HTTPRedirectDefalteEncoder/Decoder if I can get the cert verification to work. So please help.

I'm not sure if we can upgrade to v3 right now, but we will sooner or later. So please provide the pointers to v3. Just wonder how much has changed in the core area between v2 and v3 as some indication about much is involved to upgrade? Also how much has change with Redirect binding and signature verification?

Gang Yang

Shonborn-Becker Systems Inc. (SBSI)
Contractor Engineering Supporting SEC
Office: 732-982-8561, x427

Cell: 732-788-7501<tel:732-740-4656>
Email: gang.yang.ctr at mail.mil<mailto:gang.yang.ctr at mail.mil>

________________________________
From: dev [dev-bounces at shibboleth.net] on behalf of Cantor, Scott [cantor.2 at osu.edu]
Sent: Thursday, April 07, 2016 11:45 AM
To: Shib Dev
Subject: [Non-DoD Source] RE: How to verify the message signature with HTTPRedirectDeflateDecoder?

All active links contained in this email were disabled.  Please verify the identity of the sender, and confirm the authenticity of all links contained within the message prior to copying and pasting the address to a Web browser.

----

> I'm using OpenSAML 2.5.1 to implement SSO using SAML 2.0 Redirect
> Binding/Profile.

That's a really bad idea. V2 is end of life functionally now and security support ends in 4 months. So you're about to own a lot of code, if you continue down that path.

> I've got the sending and receiving working. But I noticed that
> the receiving side did not seem to verify the signature. Of course I may not
> have set it up to do so, but I don't know how. I have the following questions
> and hope someone knowledgeable would provide some help and poitners.

You really should be using Shibboleth or some other existing implementation, and not implementing this yourself. But the Shibboleth code base is the best extant set of sample code there is if you're going to do this. I can point to exactly the code that implements this in V3, but I'm not going to go searching for anything in V2.

You also haven't indicated what trust model you're trying to implement, and if you don't know the answer to that, you would need to do a lot more reading and learning before attempting to implement SAML. This is a pretty decent intro to the topic. [1]

> - Based on my understanding, SAML 2.0 Redirect Binding does not send the
> signing certificate. Is this correct? I need it for encrypting the returned SAML
> assertion.

That is correct, yes. You can't assume that it would be the same key, even if you did receive it that way.

> - If the above it true, how does the receiving side obtain the right cert and
> verify the signature? Metadata? What if I did not implement Metadata?

If you don't implement metadata, then you are just going to reinvent it yourself, so conceptually that's the answer either way.

> - How is HTTPRedirectDeflateDecoder designed to work in regard to
> signature verification? Is it out side the scope of
> HTTPRedirectDeflateDecoder, or there is some setup to be done in order to
> get the signature verified?

It's outside the scope, you run message handlers over the message to perform security checks and one of those is a handler to verify a binding level signature against a trust engine.

I urge you to reconsider implementing this from scratch unless you're building an SP in Java (but an SP would only need to verify a redirect signature for logout).

-- Scott

[1] Caution-https://wiki.shibboleth.net/confluence/display/CONCEPT/TrustManagement

--
To unsubscribe from this list send an email to dev-unsubscribe at shibboleth.net
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20160407/99909503/attachment.html>