Problems with validating signatures in OpenSAML 3.0

[Brent Putman]

On 9/12/16 4:13 PM, Lasse Højgaard wrote:
>
> Opensaml-xmlsec-impl is already on the classpath of my application. I'm using OpenSAML v3.2.

Ok, that's good.  Are you pulling jars from our Maven repo, or did you
build from source, etc?  If the latter: check you opensaml-xmlsec-impl
jar to make sure you have the file with that entry under
META-INF/services, like this:

http://svn.shibboleth.net/view/java-opensaml/trunk/opensaml-xmlsec-impl/src/main/resources/META-INF/services/org.opensaml.xmlsec.signature.support.SignatureValidationProvider?view=markup

Just thinking that maybe something in a non-standard source build might
be stripping out the jar resources or something like that.

> Where can I find more information on the Services API? 


The actual spec is in the jar file specification. [1] It's pretty
minimal. The name is confusing.  There they refer to it as the Service
Provider API.  I think elsewhere I've seen/heard it referred to as the
Service API or Services API.

It's been there for quite a long time - Java 1.4 or 1.3, maybe even
earlier.  However, Oracle Java only added official code to support it in
6+ (or maybe it was 5+...); prior to that you had to devise your own
code.  There's really just one relevant class, whose Javadocs are
informative. [2]  


> JCE is installed on my test-server, but I have added a call to JavaCryptoValidationInitializer.init in my startup code.

Well, that's not at all relevant to the error you reported.

But: You actually shouldn't have to do that explicitly, I think. It
should be called automatically by InitializationService.initialize(),
via its declaration in:

opensaml-xmlsec-impl/src/main/resources/META-INF/services/org.opensaml.core.config.Initializer

Btw, that is because the whole init process in v3 is also
(coincidentally) based on the same jar spec service provider API.



> I have a problem with my IdP right now, but will try to manually add a META-INF/services entry tomorrow to my SP code.
> In the logs there are no errors regarding XMLObjectProviders etc.

Ok, then your initialization must be fundamentally working

> To be clear: the only thing in my entire SAML implementation that fails right now is the validation of signatures of assertions.
> If I disable that, everything else works, including signing of outgoing requests. 

If your xmlsec-impl jar looks OK, then honestly I don't have an
explanation.  No one has ever reported such an issue.  And if all the
other things that use the jar service provider API are working, then I
can't explain why one  particular one would not work.



[1]
http://docs.oracle.com/javase/7/docs/technotes/guides/jar/jar.html#Service_Provider

[2] https://docs.oracle.com/javase/7/docs/api/java/util/ServiceLoader.html
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20160912/4ff22ca0/attachment-0001.html>