OpenSAML 3.2.0 not generating proper signatures

[Marc Boorshtein]

I'm migrating my code base from OpenSAML 2 to 3 and have encountered an
issue with the signatures being generated.  I'm generating the below SAML
response:

<saml2p:Response xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol"
                 xmlns:xsd="http://www.w3.org/2001/XMLSchema"
                 Destination="
http://shib2x.tremolo.lan/Shibboleth.sso/SAML2/POST"
                 ID="fd2e829e77881b351b490d9dc19cff85a27f7a8ea"
                 IssueInstant="2017-01-03T17:26:51.255Z"
                 Version="2.0"
                 >
<saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">
http://localhost.localdomain:6060/auth/idp/saml2</saml2:Issuer>
<ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
<ds:SignedInfo>
<ds:CanonicalizationMethod Algorithm="
http://www.w3.org/2001/10/xml-exc-c14n#" />
<ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"
/>
<ds:Reference URI="#fd2e829e77881b351b490d9dc19cff85a27f7a8ea">
<ds:Transforms>
<ds:Transform Algorithm="
http://www.w3.org/2000/09/xmldsig#enveloped-signature" />
<ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#">
<ec:InclusiveNamespaces xmlns:ec="http://www.w3.org/2001/10/xml-exc-c14n#"
                       PrefixList="xsd"
                       />
</ds:Transform>
</ds:Transforms>
<ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256" />
<ds:DigestValue>ubwqWUjtEDYwRTJjadkpbqqyp36qStUdqKXNyNjSrXg=</ds:DigestValue>
</ds:Reference>
</ds:SignedInfo>
<ds:SignatureValue>
fFXh1Xh4sFVjtuc3jidXJsQ4+HcMp9km8bHSrvAz6ZUoLaH49Hnv0aPosagxSdja0//XgJRSf6x3
v0t67n4/KLSFDyULJbe4rFjEFtxQL8AAtuUEghQd3Hfwg4+a1Pl6TKlrNVVi0g1l9EcA2QsrCx0R
HrleGjAO7e/zvK5tsg8=
</ds:SignatureValue>
</ds:Signature>
<saml2p:Status>
<saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" />
</saml2p:Status>
<saml2:Assertion xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"
                ID="fb777d662ef7f844d59a86196cf76b9a85c606eac"
                IssueInstant="2017-01-03T17:26:51.255Z"
                Version="2.0"
                >
<saml2:Issuer>http://localhost.localdomain:6060/auth/idp/saml2
</saml2:Issuer>
<saml2:Subject>
<saml2:NameID
Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified">testsaml2</saml2:NameID>
<saml2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
<saml2:SubjectConfirmationData NotOnOrAfter="2017-01-03T17:31:51.254Z"
                              Recipient="
http://shib2x.tremolo.lan/Shibboleth.sso/SAML2/POST"
                              />
</saml2:SubjectConfirmation>
</saml2:Subject>
<saml2:Conditions NotBefore="2017-01-03T17:21:51.254Z"
                 NotOnOrAfter="2017-01-03T17:31:51.254Z"
                 >
<saml2:AudienceRestriction>
<saml2:Audience>http://shib2x.tremolo.lan/shibboleth</saml2:Audience>
</saml2:AudienceRestriction>
</saml2:Conditions>
<saml2:AuthnStatement AuthnInstant="2017-01-03T17:26:51.255Z"

 SessionIndex="fb777d662ef7f844d59a86196cf76b9a85c606eac"
                     >
<saml2:AuthnContext>
<saml2:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml2:AuthnContextClassRef>
</saml2:AuthnContext>
</saml2:AuthnStatement>
<saml2:AttributeStatement>
<saml2:Attribute Name="groupName">
<saml2:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
                     xsi:type="xsd:string"
                     >testUsers</saml2:AttributeValue>
</saml2:Attribute>
<saml2:Attribute Name="role">
<saml2:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
                     xsi:type="xsd:string"
                     >users</saml2:AttributeValue>
</saml2:Attribute>
<saml2:Attribute Name="l">
<saml2:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
                     xsi:type="xsd:string"
                     >Boston</saml2:AttributeValue>
</saml2:Attribute>
</saml2:AttributeStatement>
</saml2:Assertion>
</saml2p:Response>

but everything i test against fails (Shib, OpenAM, ADFS).  I tried
validating it at samltool.com but I get the error "Reference validation
failed".  The only issue I see in the reference section is its generating a
sha256 digest rather then a sha1 digest the way my 2.x code did.  Here's
the code I used to generate the signature:

BasicX509Credential signingCredential =
CredentialSupport.getSimpleCredential(this.sigCert, this.sigKey);

Signature signature = OpenSAMLUtils.buildSAMLObject(Signature.class);

//SecurityHelper.prepareSignatureParams(signature, signingCredential, null,
null);

signature.setSigningCredential(signingCredential);

signature.setSignatureAlgorithm(SignatureConstants.
ALGO_ID_SIGNATURE_RSA_SHA1);

signature.setCanonicalizationAlgorithm(SignatureConstants.
ALGO_ID_C14N_EXCL_OMIT_COMMENTS);

r.setSignature(signature);

//Element e = Configuration.getMarshallerFactory().getMarshaller(r).marshall
(r);

try {


XMLObjectProviderRegistrySupport.getMarshallerFactory().getMarshaller(r
).marshall(r);

        } catch (MarshallingException e) {

            throw new RuntimeException(e);

        }

Signer.signObject(signature);


I got the code out of "*A Guide to OpenSAML V3
<https://gumroad.com/l/ypPk>"*


Thoughts?

Thanks
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20170103/b6de3531/attachment.html>