Problems with validating signatures in OpenSAML 3.0
Lasse Højgaard
lash at stibosystems.com
Mon Sep 12 08:15:59 EDT 2016
Hi again,
I've managed to enable more logging and now I'm getting this error: A few client-critical details have been removed.
Resolving credentials from supplied RoleDescriptor using usage: SIGNING. Effective entityID was: REDACTED
2016/09/12-13:59:55 35 org.opensaml.saml.security.impl.MetadataCredentialResolver extractCredentials FINE: Found no cached credentials in KeyDescriptor object metadata, resolving from KeyInfo
2016/09/12-13:59:55 35 org.opensaml.xmlsec.keyinfo.impl.BasicProviderKeyInfoCredentialResolver initResolutionContext FINE: Found 0 key names: []
2016/09/12-13:59:55 35 org.opensaml.xmlsec.keyinfo.impl.BasicProviderKeyInfoCredentialResolver processKeyInfoChildren FINE: Processing KeyInfo child with QName: {http://www.w3.org/2000/09/xmldsig#}X509Data
2016/09/12-13:59:55 35 org.opensaml.xmlsec.keyinfo.impl.BasicProviderKeyInfoCredentialResolver processKeyInfoChild FINE
Provider org.opensaml.xmlsec.keyinfo.impl.provider.RSAKeyValueProvider doesn't handle objects of type {http://www.w3.org/2000/09/xmldsig#}X509Data, skipping
2016/09/12-13:59:55 35 org.opensaml.xmlsec.keyinfo.impl.BasicProviderKeyInfoCredentialResolver processKeyInfoChild FINE
Provider org.opensaml.xmlsec.keyinfo.impl.provider.DSAKeyValueProvider doesn't handle objects of type {http://www.w3.org/2000/09/xmldsig#}X509Data, skipping
2016/09/12-13:59:55 35 org.opensaml.xmlsec.keyinfo.impl.BasicProviderKeyInfoCredentialResolver processKeyInfoChild FINE
Provider org.opensaml.xmlsec.keyinfo.impl.provider.DEREncodedKeyValueProvider doesn't handle objects of type {http://www.w3.org/2000/09/xmldsig#}X509Data, skipping
2016/09/12-13:59:55 35 org.opensaml.xmlsec.keyinfo.impl.BasicProviderKeyInfoCredentialResolver processKeyInfoChild FINE
Processing KeyInfo child {http://www.w3.org/2000/09/xmldsig#}X509Data with provider org.opensaml.xmlsec.keyinfo.impl.provider.InlineX509DataProvider
2016/09/12-13:59:55 35 org.opensaml.xmlsec.keyinfo.impl.provider.InlineX509DataProvider process FINE: Attempting to extract credential from an X509Data
2016/09/12-13:59:55 35 org.opensaml.xmlsec.keyinfo.impl.provider.InlineX509DataProvider extractCertificates FINE: Found 1 X509Certificates
2016/09/12-13:59:55 35 org.opensaml.xmlsec.keyinfo.impl.provider.InlineX509DataProvider extractCRLs FINE: Found 0 X509CRLs
2016/09/12-13:59:55 35 org.opensaml.xmlsec.keyinfo.impl.provider.InlineX509DataProvider findEntityCert FINE: Single certificate was present, treating as end-entity certificate
2016/09/12-13:59:55 35 org.opensaml.xmlsec.keyinfo.impl.BasicProviderKeyInfoCredentialResolver processKeyInfoChild FINE
Credentials successfully extracted from child {http://www.w3.org/2000/09/xmldsig#}X509Data by provider org.opensaml.xmlsec.keyinfo.impl.provider.InlineX509DataProvider
2016/09/12-13:59:55 35 org.opensaml.xmlsec.keyinfo.impl.BasicProviderKeyInfoCredentialResolver resolveFromSource FINE: A total of 1 credentials were resolved
2016/09/12-13:59:55 35 org.opensaml.security.credential.criteria.impl.EvaluableCredentialCriteriaRegistry loadDefaultMappings FINE: Loading default evaluable credential criteria mappings
2016/09/12-13:59:55 35 org.opensaml.security.credential.criteria.impl.EvaluableCredentialCriteriaRegistry register FINE
Registering class org.opensaml.security.credential.criteria.impl.EvaluableX509DigestCredentialCriterion as evaluator for class org.opensaml.security.x509.X509DigestCriterion
2016/09/12-13:59:55 35 org.opensaml.security.credential.criteria.impl.EvaluableCredentialCriteriaRegistry register FINE
Registering class org.opensaml.security.credential.criteria.impl.EvaluablePublicKeyCredentialCriterion as evaluator for class org.opensaml.security.criteria.PublicKeyCriterion
2016/09/12-13:59:55 35 org.opensaml.security.credential.criteria.impl.EvaluableCredentialCriteriaRegistry register FINE
Registering class org.opensaml.security.credential.criteria.impl.EvaluableX509IssuerSerialCredentialCriterion as evaluator for class org.opensaml.security.x509.X509IssuerSerialCriterion
2016/09/12-13:59:55 35 org.opensaml.security.credential.criteria.impl.EvaluableCredentialCriteriaRegistry register FINE
Registering class org.opensaml.security.credential.criteria.impl.EvaluableX509SubjectKeyIdentifierCredentialCriterion as evaluator for class org.opensaml.security.x509.X509SubjectKeyIdentifierCriterion
2016/09/12-13:59:55 35 org.opensaml.security.credential.criteria.impl.EvaluableCredentialCriteriaRegistry register FINE
Registering class org.opensaml.security.credential.criteria.impl.EvaluableKeyNameCredentialCriterion as evaluator for class org.opensaml.security.criteria.KeyNameCriterion
2016/09/12-13:59:55 35 org.opensaml.security.credential.criteria.impl.EvaluableCredentialCriteriaRegistry register FINE
Registering class org.opensaml.security.credential.criteria.impl.EvaluableKeyAlgorithmCredentialCriterion as evaluator for class org.opensaml.security.criteria.KeyAlgorithmCriterion
2016/09/12-13:59:55 35 org.opensaml.security.credential.criteria.impl.EvaluableCredentialCriteriaRegistry register FINE
Registering class org.opensaml.security.credential.criteria.impl.EvaluableEntityIDCredentialCriterion as evaluator for class org.opensaml.core.criterion.EntityIdCriterion
2016/09/12-13:59:55 35 org.opensaml.security.credential.criteria.impl.EvaluableCredentialCriteriaRegistry register FINE
Registering class org.opensaml.security.credential.criteria.impl.EvaluableUsageCredentialCriterion as evaluator for class org.opensaml.security.criteria.UsageCriterion
2016/09/12-13:59:55 35 org.opensaml.security.credential.criteria.impl.EvaluableCredentialCriteriaRegistry register FINE
Registering class org.opensaml.security.credential.criteria.impl.EvaluableKeyLengthCredentialCriterion as evaluator for class org.opensaml.security.criteria.KeyLengthCriterion
2016/09/12-13:59:55 35 org.opensaml.security.credential.criteria.impl.EvaluableCredentialCriteriaRegistry register FINE
Registering class org.opensaml.security.credential.criteria.impl.EvaluableX509SubjectNameCredentialCriterion as evaluator for class org.opensaml.security.x509.X509SubjectNameCriterion
2016/09/12-13:59:55 35 org.opensaml.security.credential.criteria.impl.EvaluableCredentialCriteriaRegistry getEvaluator FINE
Registry could not locate evaluable criteria for criteria class org.opensaml.xmlsec.keyinfo.KeyInfoCriterion
2016/09/12-13:59:55 35 org.opensaml.security.credential.criteria.impl.EvaluableCredentialCriteriaRegistry getEvaluator FINE
Registry located evaluable criteria class org.opensaml.security.credential.criteria.impl.EvaluableKeyAlgorithmCredentialCriterion for criteria class org.opensaml.security.criteria.KeyAlgorithmCriterion
2016/09/12-13:59:55 35 org.opensaml.security.credential.criteria.impl.EvaluableCredentialCriteriaRegistry getEvaluator FINE
Registry located evaluable criteria class org.opensaml.security.credential.criteria.impl.EvaluableEntityIDCredentialCriterion for criteria class org.opensaml.core.criterion.EntityIdCriterion
2016/09/12-13:59:55 35 org.opensaml.security.credential.criteria.impl.EvaluableCredentialCriteriaRegistry getEvaluator FINE
Registry located evaluable criteria class org.opensaml.security.credential.criteria.impl.EvaluableUsageCredentialCriterion for criteria class org.opensaml.security.criteria.UsageCriterion
2016/09/12-13:59:55 35 org.opensaml.security.credential.criteria.impl.EvaluableCredentialCriteriaRegistry getEvaluator FINE
Registry could not locate evaluable criteria for criteria class org.opensaml.saml.criterion.RoleDescriptorCriterion
2016/09/12-13:59:55 35 org.opensaml.xmlsec.signature.support.impl.BaseSignatureTrustEngine validate FINE: Attempting to verify signature and establish trust using KeyInfo-derived credentials
2016/09/12-13:59:55 35 org.opensaml.xmlsec.keyinfo.impl.BasicProviderKeyInfoCredentialResolver initResolutionContext FINE: Found 0 key names: []
2016/09/12-13:59:55 35 org.opensaml.xmlsec.keyinfo.impl.BasicProviderKeyInfoCredentialResolver processKeyInfoChildren FINE: Processing KeyInfo child with QName: {http://www.w3.org/2000/09/xmldsig#}X509Data
2016/09/12-13:59:55 35 org.opensaml.xmlsec.keyinfo.impl.BasicProviderKeyInfoCredentialResolver processKeyInfoChild FINE
Provider org.opensaml.xmlsec.keyinfo.impl.provider.RSAKeyValueProvider doesn't handle objects of type {http://www.w3.org/2000/09/xmldsig#}X509Data, skipping
2016/09/12-13:59:55 35 org.opensaml.xmlsec.keyinfo.impl.BasicProviderKeyInfoCredentialResolver processKeyInfoChild FINE
Provider org.opensaml.xmlsec.keyinfo.impl.provider.DSAKeyValueProvider doesn't handle objects of type {http://www.w3.org/2000/09/xmldsig#}X509Data, skipping
2016/09/12-13:59:55 35 org.opensaml.xmlsec.keyinfo.impl.BasicProviderKeyInfoCredentialResolver processKeyInfoChild FINE
Provider org.opensaml.xmlsec.keyinfo.impl.provider.DEREncodedKeyValueProvider doesn't handle objects of type {http://www.w3.org/2000/09/xmldsig#}X509Data, skipping
2016/09/12-13:59:55 35 org.opensaml.xmlsec.keyinfo.impl.BasicProviderKeyInfoCredentialResolver processKeyInfoChild FINE
Processing KeyInfo child {http://www.w3.org/2000/09/xmldsig#}X509Data with provider org.opensaml.xmlsec.keyinfo.impl.provider.InlineX509DataProvider
2016/09/12-13:59:55 35 org.opensaml.xmlsec.keyinfo.impl.provider.InlineX509DataProvider process FINE: Attempting to extract credential from an X509Data
2016/09/12-13:59:55 35 org.opensaml.xmlsec.keyinfo.impl.provider.InlineX509DataProvider extractCertificates FINE: Found 1 X509Certificates
2016/09/12-13:59:55 35 org.opensaml.xmlsec.keyinfo.impl.provider.InlineX509DataProvider extractCRLs FINE: Found 0 X509CRLs
2016/09/12-13:59:55 35 org.opensaml.xmlsec.keyinfo.impl.provider.InlineX509DataProvider findEntityCert FINE: Single certificate was present, treating as end-entity certificate
2016/09/12-13:59:55 35 org.opensaml.xmlsec.keyinfo.impl.BasicProviderKeyInfoCredentialResolver processKeyInfoChild FINE
Credentials successfully extracted from child {http://www.w3.org/2000/09/xmldsig#}X509Data by provider org.opensaml.xmlsec.keyinfo.impl.provider.InlineX509DataProvider
2016/09/12-13:59:55 35 org.opensaml.xmlsec.keyinfo.impl.BasicProviderKeyInfoCredentialResolver resolveFromSource FINE: A total of 1 credentials were resolved
2016/09/12-13:59:55 35 org.opensaml.security.credential.criteria.impl.EvaluableCredentialCriteriaRegistry getEvaluator FINE
Registry could not locate evaluable criteria for criteria class org.opensaml.xmlsec.keyinfo.KeyInfoCriterion
2016/09/12-13:59:55 35 org.opensaml.xmlsec.signature.support.impl.BaseSignatureTrustEngine verifySignature FINE: Signature validation using candidate validation credential failed
org.opensaml.xmlsec.signature.support.SignatureException: Could not load a signature validation provider implementation via service API
at org.opensaml.xmlsec.signature.support.SignatureValidator.getSignatureValidationProvider(SignatureValidator.java:70)
at org.opensaml.xmlsec.signature.support.SignatureValidator.validate(SignatureValidator.java:52)
at org.opensaml.xmlsec.signature.support.impl.BaseSignatureTrustEngine.verifySignature(BaseSignatureTrustEngine.java:242)
at org.opensaml.xmlsec.signature.support.impl.BaseSignatureTrustEngine.validate(BaseSignatureTrustEngine.java:198)
at org.opensaml.xmlsec.signature.support.impl.ExplicitKeySignatureTrustEngine.doValidate(ExplicitKeySignatureTrustEngine.java:108)
at org.opensaml.xmlsec.signature.support.impl.BaseSignatureTrustEngine.validate(BaseSignatureTrustEngine.java:105)
at org.opensaml.xmlsec.signature.support.impl.BaseSignatureTrustEngine.validate(BaseSignatureTrustEngine.java:62)
... custom code calls here
at com.stibo.portal.engine.server.auth.http.impl.HttpAuthInstance.authenticateRequest(HttpAuthInstance.java:39)
at com.stibo.portal.engine.server.auth.http.impl.HttpAuthManagerImpl.authenticateRequest(HttpAuthManagerImpl.java:170)
at com.stibo.portal.engine.server.servlet.filter.AuthMasterFilter.invokeHttpAuthManager(AuthMasterFilter.java:182)
at com.stibo.portal.engine.server.servlet.filter.AuthMasterFilter.handleAuth(AuthMasterFilter.java:118)
at com.stibo.portal.engine.server.servlet.filter.AuthMasterFilter.doFilter(AuthMasterFilter.java:92)
at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1652)
at com.stibo.portal.engine.server.servlet.filter.CsrfFilter.doFilter(CsrfFilter.java:85)
at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1652)
at com.stibo.portal.engine.server.servlet.filter.SecurityFilter$1.run(SecurityFilter.java:119)
at com.stibo.util.logging.iproutetracker.IpRouteTracker.execute(IpRouteTracker.java:39)
at com.stibo.portal.engine.server.servlet.filter.SecurityFilter.doFilter(SecurityFilter.java:114)
at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1652)
at org.eclipse.jetty.servlet.ServletHandler.doHandle(ServletHandler.java:585)
at org.ops4j.pax.web.service.jetty.internal.HttpServiceServletHandler.doHandle(HttpServiceServletHandler.java:70)
at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:143)
at org.eclipse.jetty.security.SecurityHandler.handle(SecurityHandler.java:577)
at org.eclipse.jetty.server.session.SessionHandler.doHandle(SessionHandler.java:223)
at org.eclipse.jetty.server.handler.ContextHandler.doHandle(ContextHandler.java:1125)
at org.ops4j.pax.web.service.jetty.internal.HttpServiceContext.doHandle(HttpServiceContext.java:267)
at org.eclipse.jetty.servlet.ServletHandler.doScope(ServletHandler.java:515)
at org.eclipse.jetty.server.session.SessionHandler.doScope(SessionHandler.java:185)
at org.eclipse.jetty.server.handler.ContextHandler.doScope(ContextHandler.java:1059)
at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:141)
at org.ops4j.pax.web.service.jetty.internal.JettyServerHandlerCollection.handle(JettyServerHandlerCollection.java:80)
at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:97)
at org.eclipse.jetty.server.Server.handle(Server.java:497)
at org.eclipse.jetty.server.HttpChannel.handle(HttpChannel.java:313)
at org.eclipse.jetty.server.HttpConnection.onFillable(HttpConnection.java:248)
at org.eclipse.jetty.io.AbstractConnection$2.run(AbstractConnection.java:540)
at org.eclipse.jetty.util.thread.QueuedThreadPool.runJob(QueuedThreadPool.java:626)
at org.eclipse.jetty.util.thread.QueuedThreadPool$3.run(QueuedThreadPool.java:546)
at java.lang.Thread.run(Thread.java:745)
2016/09/12-13:59:55 35 org.opensaml.xmlsec.signature.support.impl.BaseSignatureTrustEngine validate FINE: Failed to verify signature and/or establish trust using any KeyInfo-derived credentials
2016/09/12-13:59:55 35 org.opensaml.xmlsec.signature.support.impl.ExplicitKeySignatureTrustEngine doValidate FINE: Attempting to verify signature using trusted credentials
2016/09/12-13:59:55 35 org.opensaml.xmlsec.signature.support.impl.BaseSignatureTrustEngine verifySignature FINE: Signature validation using candidate validation credential failed
org.opensaml.xmlsec.signature.support.SignatureException: Could not load a signature validation provider implementation via service API
at org.opensaml.xmlsec.signature.support.SignatureValidator.getSignatureValidationProvider(SignatureValidator.java:70)
at org.opensaml.xmlsec.signature.support.SignatureValidator.validate(SignatureValidator.java:52)
at org.opensaml.xmlsec.signature.support.impl.BaseSignatureTrustEngine.verifySignature(BaseSignatureTrustEngine.java:242)
at org.opensaml.xmlsec.signature.support.impl.ExplicitKeySignatureTrustEngine.doValidate(ExplicitKeySignatureTrustEngine.java:118)
at org.opensaml.xmlsec.signature.support.impl.BaseSignatureTrustEngine.validate(BaseSignatureTrustEngine.java:105)
at org.opensaml.xmlsec.signature.support.impl.BaseSignatureTrustEngine.validate(BaseSignatureTrustEngine.java:62)
... more custom code
at com.stibo.portal.engine.server.auth.http.impl.HttpAuthInstance.authenticateRequest(HttpAuthInstance.java:39)
at com.stibo.portal.engine.server.auth.http.impl.HttpAuthManagerImpl.authenticateRequest(HttpAuthManagerImpl.java:170)
at com.stibo.portal.engine.server.servlet.filter.AuthMasterFilter.invokeHttpAuthManager(AuthMasterFilter.java:182)
at com.stibo.portal.engine.server.servlet.filter.AuthMasterFilter.handleAuth(AuthMasterFilter.java:118)
at com.stibo.portal.engine.server.servlet.filter.AuthMasterFilter.doFilter(AuthMasterFilter.java:92)
at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1652)
at com.stibo.portal.engine.server.servlet.filter.CsrfFilter.doFilter(CsrfFilter.java:85)
at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1652)
at com.stibo.portal.engine.server.servlet.filter.SecurityFilter$1.run(SecurityFilter.java:119)
at com.stibo.util.logging.iproutetracker.IpRouteTracker.execute(IpRouteTracker.java:39)
at com.stibo.portal.engine.server.servlet.filter.SecurityFilter.doFilter(SecurityFilter.java:114)
at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1652)
at org.eclipse.jetty.servlet.ServletHandler.doHandle(ServletHandler.java:585)
at org.ops4j.pax.web.service.jetty.internal.HttpServiceServletHandler.doHandle(HttpServiceServletHandler.java:70)
at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:143)
at org.eclipse.jetty.security.SecurityHandler.handle(SecurityHandler.java:577)
at org.eclipse.jetty.server.session.SessionHandler.doHandle(SessionHandler.java:223)
at org.eclipse.jetty.server.handler.ContextHandler.doHandle(ContextHandler.java:1125)
at org.ops4j.pax.web.service.jetty.internal.HttpServiceContext.doHandle(HttpServiceContext.java:267)
at org.eclipse.jetty.servlet.ServletHandler.doScope(ServletHandler.java:515)
at org.eclipse.jetty.server.session.SessionHandler.doScope(SessionHandler.java:185)
at org.eclipse.jetty.server.handler.ContextHandler.doScope(ContextHandler.java:1059)
at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:141)
at org.ops4j.pax.web.service.jetty.internal.JettyServerHandlerCollection.handle(JettyServerHandlerCollection.java:80)
at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:97)
at org.eclipse.jetty.server.Server.handle(Server.java:497)
at org.eclipse.jetty.server.HttpChannel.handle(HttpChannel.java:313)
at org.eclipse.jetty.server.HttpConnection.onFillable(HttpConnection.java:248)
at org.eclipse.jetty.io.AbstractConnection$2.run(AbstractConnection.java:540)
at org.eclipse.jetty.util.thread.QueuedThreadPool.runJob(QueuedThreadPool.java:626)
at org.eclipse.jetty.util.thread.QueuedThreadPool$3.run(QueuedThreadPool.java:546)
at java.lang.Thread.run(Thread.java:745)
2016/09/12-13:59:55 35 org.opensaml.xmlsec.signature.support.impl.ExplicitKeySignatureTrustEngine doValidate FINE: Failed to verify signature using either KeyInfo-derived or directly trusted credentials
As before I'm using the SignatureTrustEngine like this:
public SignatureTrustEngine getSignatureTrustEngine() throws ComponentInitializationException{
BasicRoleDescriptorResolver basicRoleDescriptorResolver = new BasicRoleDescriptorResolver(getMetadataResolver());
MetadataCredentialResolver mcr = new MetadataCredentialResolver();
KeyInfoCredentialResolver keyInfoCredentialResolver = DefaultSecurityConfigurationBootstrap.buildBasicInlineKeyInfoCredentialResolver();
mcr.setRoleDescriptorResolver(basicRoleDescriptorResolver);
mcr.setKeyInfoCredentialResolver(keyInfoCredentialResolver);
mcr.initialize();
return new ExplicitKeySignatureTrustEngine(mcr, keyInfoCredentialResolver);
}
And the actual validation:
public boolean validateAssertion(Assertion assertion, IdentityProviderMetadata idpMetadata) throws ComponentInitializationException, SignatureException, SecurityException {
logger.log(Level.FINE, "Attempting to validate assertion");
SAMLUtil.logDOMElement(assertion.getDOM());
if (!assertion.isSigned()) {
logger.log(Level.SEVERE, "Assertion not signed", assertion);
throw new SAMLRuntimeException("The SAML Assertion was not signed");
}
SAMLSignatureProfileValidator profileValidator = new SAMLSignatureProfileValidator();
profileValidator.validate(assertion.getSignature());
logger.log(Level.FINEST, "Profilevalidation completed");
SignatureTrustEngine signatureTrustEngine = idpMetadata.getSignatureTrustEngine();
logger.log(Level.FINEST, "IdP entityID: " + assertion.getIssuer().getValue());
CriteriaSet criteriaSet = new CriteriaSet();
criteriaSet.add( new EntityIdCriterion(assertion.getIssuer().getValue()) );
criteriaSet.add(new UsageCriterion(UsageType.SIGNING));
criteriaSet.add(new RoleDescriptorCriterion(idpMetadata.getMetadata().getIDPSSODescriptor(SAMLConstants.SAML20P_NS)));
return signatureTrustEngine.validate(assertion.getSignature(), criteriaSet);
Any idea what's going on here?
Lasse Højgaard
Consultant
From: dev [mailto:dev-bounces at shibboleth.net] On Behalf Of Brent Putman
Sent: 7. september 2016 23:37
To: dev at shibboleth.net
Subject: Re: Problems with validating signatures in OpenSAML 3.0
On 9/7/16 8:25 AM, Lasse Højgaard wrote:
Hi list,
My system is acting as the SP in this case.
I'm trying to validate the signature of incoming assertions, with the public key from the IdP's metadata.
I don't see anything obviously wrong with the metadata and code you posted. But it's possible I'm missing something.
The error seems to be in the actual byte comparison for the RSA-SHA1 algorithm.
If you haven't already done so, I'd start with getting a full DEBUG log trace from OpenSAML of the whole operation. That will confirm precisely where it's failing: the actual cryptographic validation of the signature, vs. the trust eval of the signing key, vs something else.
If it really turns out to be that the signature won't validate, you'd want to compare the bytes of what the IdP is actually signing with what the SP is verifying. This info is still relevant, even though it's in OpenSAML 2 wiki:
https://wiki.shibboleth.net/confluence/display/OpenSAML/OSTwoUserManSigErrors
In particular section 5, on how to get DEBUG log from Apache Santuario of the bytes to be digested. You didn't say what the IdP is, so you may or may not be able to get the similar log data from that side.
However! I was able to successfully validate the assertion using the online tool: https://www.samltool.com/validate_response.php
If the response/assertion signature validates there, then that actually is a good indication that in fact there is a problem in your code somewhere. Maybe it's something subtle with the metadata or entityID, or with how you're setting up the trust engine. Getting some DEBUG logging would help diagnose that.
More information about the dev
mailing list