Problems with validating signatures in OpenSAML 3.0

[Brent Putman]

On 9/7/16 8:25 AM, Lasse Højgaard wrote:
> Hi list,
>
> My system is acting as the SP in this case.
> I'm trying to validate the signature of incoming assertions, with the public key from the IdP's metadata.
>
>

I don't see anything obviously wrong with the metadata and code you
posted.  But it's possible I'm missing something.

> The error seems to be in the actual byte comparison for the RSA-SHA1 algorithm.


If you haven't already done so, I'd start with getting a full DEBUG log
trace from OpenSAML of the whole operation.  That will confirm
precisely where it's failing: the actual cryptographic validation of
the signature, vs. the trust eval of the signing key, vs something else.

If it really turns out to be that the signature won't validate, you'd
want to compare the bytes of what the IdP is actually signing with what
the SP is verifying.  This info is still relevant, even though it's in
OpenSAML 2 wiki:

https://wiki.shibboleth.net/confluence/display/OpenSAML/OSTwoUserManSigErrors

In particular section 5, on how to get DEBUG log from Apache Santuario
of the bytes to be digested.  You didn't say what the IdP is, so you
may or may not be able to get the similar log data from that side.

> However! I was able to successfully validate the assertion using the online tool: https://www.samltool.com/validate_response.php 

If the response/assertion signature validates there, then that actually
is a good indication that in fact there is a problem in your code
somewhere.  Maybe it's something subtle with the metadata or entityID, 
or with how you're setting up the trust engine.  Getting some DEBUG
logging would help diagnose that.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20160907/0f62ce2c/attachment.html>