AuthNRequest profile signature validation failure w/ ECP HTTPSOAP11Decoder

[Cantor, Scott]

> <Apache xmlsec IdResolver could not resolve the Element for id reference:
> _dea44c5bb9ee8778f82c946f82948065>

That means the Signature's Reference element is pointing to that ID and it's not in the DOM. If the element is there on input, then the DOM has been manipulated improperly and there was no setIdAttribute call to establish the IDness of the ID attribute. Bottom line, the call to getElementById() later failed.

> This page [1] relevant for OSTwo describes a technique to get around this
> issue, but I am not quite sure:
> 
> -         How that might apply to OSThree
> -         How that might apply to HTTPSOAP11Decoder

It applies to 3 but it applies to decrypted content that's been signed, and there's no such content in an AuthnRequest.

> If this helps, the test is done via the ECP script provided by CILogon against an
> IdP that is not yet an InCommon member. I understand membership is a
> requirement for the test to pass; I am wondering if the above has anything to
> do with that or it's something entirely different.

Nothing whatsoever, this is an XML processing bug, not about policy.

-- Scott