Doubt about empty reference URI element

[Sixto Garcia]

This is not a specific shibboleth question but I didn't know where to ask
it.


At the XML Signature Syntax and Processing spec [1]  it seems that empty
Reference URIs are allowed.

The following examples demonstrate what the URI attribute identifies and
how it is dereferenced:
....
URI=""
Identifies the node-set (minus any comment nodes) of the XML resource
containing the signature


>From SAML Core spec [2] I read:

1.3.2 URI Values
All SAML URI reference values have the type xs:anyURI, which is built in to
the W3C XML Schema Datatypes specification [Schema2].
Unless otherwise indicated in this specification, all URI reference values
used within SAML-defined elements or attributes MUST consist of at least
one non-whitespace character, and are REQUIRED to be absolute [RFC 2396].
Note that the SAML specification makes extensive use of URI references as
identifiers, such as status codes, format types, attribute and system
entity names, etc. In such cases, it is essential that the values be both
unique and consistent, such that the same URI is never used at different
times to represent different underlying information.

5.4.2 References
SAML assertions and protocol messages MUST supply a value for the ID
attribute on the root element of the assertion or protocol message being
signed. The assertion’s or protocol message's root element may or may not
be the root element of the actual XML document containing the signed
assertion or protocol message (e.g., it might be contained within a SOAP
envelope).

Signatures MUST contain a single <ds:Reference> containing a same-document
reference to the ID attribute value of the root element of the assertion or
protocol message being signed. For example, if the ID attribute value is
"foo", then the URI attribute in the <ds:Reference> element MUST be "#foo".



Are empty reference URI at Signatures element allowed in the SAML standard?

At this shibboleth issue I read from Ian Young [3] and [4]:

> The XMLSignatureValidationStage, because it is usable on any signed XML,
> does not enforce the SAML requirement that the signature refers to the ID
> on the document element, and instead allows a signature reference of "".



So may be not strictly allowed, but shibboleth at least seems to support it
on Signed Metadata.


I want my SAML implementation to be flexible enough, but keep following
SAML standard and follow commom SAML implementations.

May my SAML implementation support empty URIs (not only for metadata but
SAMLResponses)?



Best regards.


[1] https://www.w3.org/TR/xmldsig-core/#sec-ReferenceProcessingModel
[2] http://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf
[3] https://issues.shibboleth.net/jira/browse/MDA-91
[4] https://issues.shibboleth.net/jira/browse/MDA-119
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20160424/b78c7079/attachment.html>