OpenSAML 3.2.0 not generating proper signatures
Marc Boorshtein
mboorshtein at gmail.com
Tue Jan 3 14:35:23 EST 2017
So i forgot i had a test case that generates an assertion and tries posting
it. Here's the output:
14:33:09.631 [XNIO-2 task-1] DEBUG
org.apache.xml.security.utils.DigesterOutputStream - <saml2p:Response
xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol" Destination="
http://sp.autoidm.com:9090/auth/SAML2Auth"
ID="f95f6d8ce505467a8f2388185c0ac5d808bdb99de"
IssueInstant="2017-01-03T19:32:14.840Z" Version="2.0">
<saml2:Issuer
xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">idp:test</saml2:Issuer>
<saml2p:Status>
<saml2p:StatusCode
Value="urn:oasis:names:tc:SAML:2.0:status:Success"></saml2p:StatusCode>
</saml2p:Status>
<saml2:Assertion xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"
ID="f0f0e8a00564a917e8cc9fbf8a0effe9b28ce40cb"
IssueInstant="2017-01-03T19:32:14.840Z" Version="2.0">
<saml2:Issuer>idp:test</saml2:Issuer>
<ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
<ds:SignedInfo>
<ds:CanonicalizationMethod Algorithm="
http://www.w3.org/2001/10/xml-exc-c14n#"></ds:CanonicalizationMethod>
<ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1
"></ds:SignatureMethod>
<ds:Reference URI="#f0f0e8a00564a917e8cc9fbf8a0effe9b28ce40cb">
<ds:Transforms>
<ds:Transform Algorithm="
http://www.w3.org/2000/09/xmldsig#enveloped-signature"></ds:Transform>
<ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#
"></ds:Transform>
</ds:Transforms>
<ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256
"></ds:DigestMethod>
<ds:DigestValue>DYXiVWJSCF5uVEGD02Uh7sG/IutgdL8r6aN+UgbDA2s=</ds:DigestValue>
</ds:Reference>
</ds:SignedInfo>
<ds:SignatureValue>
bzpUxuozkD9raKuXbMzffxxVJdbDRzE9KC+yAvBoyYYALlWzZ9nNkHyMdf6UAeHGwKsPjv1pMl4y
gCUgOqzWEAc2ZIShMYB41ntjeiskpbXGmuAniBYMcTTvCBijuE+SouAnVotSZxZQhQ14EDX+cs1b
4YOVXamIGHeT8x4FSjW9fY5tHtIyKTFYDymCD0o50fF8/3QySJwcYBGn8sodCNWLkJH5B4OoqBam
lWwWPTxRseKBnXz0qYFxhxImvzBjyPPfMJ4+T7J4fYZNc3aVTht29dzw8eiSlVhcK7ez7diCwSa/
ucx01ON0aPGD9VnP59FjuLHMeMPv1aNazomoLw==
</ds:SignatureValue>
</ds:Signature>
<saml2:Subject>
<saml2:NameID
Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified">testsaml2</saml2:NameID>
<saml2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
<saml2:SubjectConfirmationData NotOnOrAfter="2017-01-03T19:37:14.839Z"
Recipient="http://sp.autoidm.com:9090/auth/SAML2Auth
"></saml2:SubjectConfirmationData>
</saml2:SubjectConfirmation>
</saml2:Subject>
<saml2:Conditions NotBefore="2017-01-03T19:27:14.839Z"
NotOnOrAfter="2017-01-03T19:37:14.839Z">
<saml2:AudienceRestriction>
<saml2:Audience>http://sp.autoidm.com:9090/auth/SAML2Auth</saml2:Audience>
</saml2:AudienceRestriction>
</saml2:Conditions>
<saml2:AuthnStatement AuthnInstant="2017-01-03T19:32:14.840Z"
SessionIndex="f0f0e8a00564a917e8cc9fbf8a0effe9b28ce40cb">
<saml2:AuthnContext>
<saml2:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml2:AuthnContextClassRef>
</saml2:AuthnContext>
</saml2:AuthnStatement>
</saml2:Assertion>
</saml2p:Response>
14:33:09.647 [XNIO-2 task-1] WARN
org.apache.xml.security.signature.Reference - Verification failed for URI
"#f95f6d8ce505467a8f2388185c0ac5d808bdb99de"
14:33:09.647 [XNIO-2 task-1] WARN
org.apache.xml.security.signature.Reference - Expected Digest:
hflsn4G02ayke70RKTRhsJNIInlK6fRTNTxcwxopu8Q=
14:33:09.647 [XNIO-2 task-1] WARN
org.apache.xml.security.signature.Reference - Actual Digest:
/cYBcqmHn1M3KXhV5W7JREjyZ4r/Sw3MFWyp5XScacM=
So clearly the digests aren't being generated the same way...
On Tue, Jan 3, 2017 at 12:56 PM, Marc Boorshtein <mboorshtein at gmail.com>
wrote:
> I'm migrating my code base from OpenSAML 2 to 3 and have encountered an
> issue with the signatures being generated. I'm generating the below SAML
> response:
>
> <saml2p:Response xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol"
> xmlns:xsd="http://www.w3.org/2001/XMLSchema"
> Destination="http://shib2x.tremolo.lan/Shibboleth.sso/
> SAML2/POST"
> ID="fd2e829e77881b351b490d9dc19cff85a27f7a8ea"
> IssueInstant="2017-01-03T17:26:51.255Z"
> Version="2.0"
> >
> <saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">http://
> localhost.localdomain:6060/auth/idp/saml2</saml2:Issuer>
> <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
> <ds:SignedInfo>
> <ds:CanonicalizationMethod Algorithm="http://www.w3.org/
> 2001/10/xml-exc-c14n#" />
> <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"
> />
> <ds:Reference URI="#fd2e829e77881b351b490d9dc19cff85a27f7a8ea">
> <ds:Transforms>
> <ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-
> signature" />
> <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#">
> <ec:InclusiveNamespaces xmlns:ec="http://www.w3.org/2001/10/xml-exc-c14n#"
> PrefixList="xsd"
> />
> </ds:Transform>
> </ds:Transforms>
> <ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256" />
> <ds:DigestValue>ubwqWUjtEDYwRTJjadkpbqqyp36qStUdqKXNyNjSrXg=</ds:
> DigestValue>
> </ds:Reference>
> </ds:SignedInfo>
> <ds:SignatureValue>
> fFXh1Xh4sFVjtuc3jidXJsQ4+HcMp9km8bHSrvAz6ZUoLaH49Hnv0aP
> osagxSdja0//XgJRSf6x3
> v0t67n4/KLSFDyULJbe4rFjEFtxQL8AAtuUEghQd3Hfwg4+
> a1Pl6TKlrNVVi0g1l9EcA2QsrCx0R
> HrleGjAO7e/zvK5tsg8=
> </ds:SignatureValue>
> </ds:Signature>
> <saml2p:Status>
> <saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" />
> </saml2p:Status>
> <saml2:Assertion xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"
> ID="fb777d662ef7f844d59a86196cf76b9a85c606eac"
> IssueInstant="2017-01-03T17:26:51.255Z"
> Version="2.0"
> >
> <saml2:Issuer>http://localhost.localdomain:6060/auth/idp/saml2
> </saml2:Issuer>
> <saml2:Subject>
> <saml2:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:
> unspecified">testsaml2</saml2:NameID>
> <saml2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
> <saml2:SubjectConfirmationData NotOnOrAfter="2017-01-03T17:31:51.254Z"
> Recipient="http://shib2x.
> tremolo.lan/Shibboleth.sso/SAML2/POST"
> />
> </saml2:SubjectConfirmation>
> </saml2:Subject>
> <saml2:Conditions NotBefore="2017-01-03T17:21:51.254Z"
> NotOnOrAfter="2017-01-03T17:31:51.254Z"
> >
> <saml2:AudienceRestriction>
> <saml2:Audience>http://shib2x.tremolo.lan/shibboleth</saml2:Audience>
> </saml2:AudienceRestriction>
> </saml2:Conditions>
> <saml2:AuthnStatement AuthnInstant="2017-01-03T17:26:51.255Z"
> SessionIndex="fb777d662ef7f844d59a86196cf76b
> 9a85c606eac"
> >
> <saml2:AuthnContext>
> <saml2:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:
> PasswordProtectedTransport</saml2:AuthnContextClassRef>
> </saml2:AuthnContext>
> </saml2:AuthnStatement>
> <saml2:AttributeStatement>
> <saml2:Attribute Name="groupName">
> <saml2:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance
> "
> xsi:type="xsd:string"
> >testUsers</saml2:AttributeValue>
> </saml2:Attribute>
> <saml2:Attribute Name="role">
> <saml2:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance
> "
> xsi:type="xsd:string"
> >users</saml2:AttributeValue>
> </saml2:Attribute>
> <saml2:Attribute Name="l">
> <saml2:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance
> "
> xsi:type="xsd:string"
> >Boston</saml2:AttributeValue>
> </saml2:Attribute>
> </saml2:AttributeStatement>
> </saml2:Assertion>
> </saml2p:Response>
>
> but everything i test against fails (Shib, OpenAM, ADFS). I tried
> validating it at samltool.com but I get the error "Reference validation
> failed". The only issue I see in the reference section is its generating a
> sha256 digest rather then a sha1 digest the way my 2.x code did. Here's
> the code I used to generate the signature:
>
> BasicX509Credential signingCredential = CredentialSupport.
> getSimpleCredential(this.sigCert, this.sigKey);
>
> Signature signature = OpenSAMLUtils.buildSAMLObject(Signature.class);
>
> //SecurityHelper.prepareSignatureParams(signature, signingCredential,
> null, null);
>
> signature.setSigningCredential(signingCredential);
>
> signature.setSignatureAlgorithm(SignatureConstants.ALGO_ID_
> SIGNATURE_RSA_SHA1);
>
> signature.setCanonicalizationAlgorithm(SignatureConstants.ALGO_ID_
> C14N_EXCL_OMIT_COMMENTS);
>
> r.setSignature(signature);
>
> //Element e = Configuration.getMarshallerFactory().getMarshaller(r).
> marshall(r);
>
> try {
>
> XMLObjectProviderRegistrySupport.getMarshallerFactory().
> getMarshaller(r).marshall(r);
>
> } catch (MarshallingException e) {
>
> throw new RuntimeException(e);
>
> }
>
> Signer.signObject(signature);
>
>
> I got the code out of "*A Guide to OpenSAML V3
> <https://gumroad.com/l/ypPk>"*
>
>
> Thoughts?
>
> Thanks
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20170103/07549923/attachment-0001.html>
More information about the dev
mailing list