[Non-DoD Source] RE: How to verify the message signature with HTTPRedirectDeflateDecoder?

[Cantor, Scott]

> The trust model is PKIX
> (static according to your article). Now a new requirement is added for
> Redirect binding.

That combination is not generally logical, and you've already pretty much figured out why.
 
> I'm not sure if we can upgrade to v3 right now, but we will sooner or later. So
> please provide the pointers to v3.

The message handler that verifies redirect signatures is org.opensaml.saml.saml2.binding.security.impl.SAML2HTTPRedirectDeflateSignatureSecurityHandler and if you follow that chain and tug on that thread it leads you to all the components like the SignatureTrustEngine interface and all its implementations that are involved in making this work.

None of it can work with PKIX because that's simply impossible apart from subverting PKIX by pre-configuring knowledge of the key. You can certainly do that, and then the PKIX step is largely redundant, but one could do something proprietary I suppose, like access the key at some untrusted location but then apply PKIX to it. Certainly nothing in any standard or in the code to help you do that.

> Just wonder how much has changed in the
> core area between v2 and v3 as some indication about much is involved to
> upgrade? Also how much has change with Redirect binding and signature
> verification?

I believe the message handling components are somewhat different, the XMLObject and security code is mostly the same, with package name changes.

-- Scott