Strange behavior with SAMLSignatureProfileValidator
Massimiliano Masi
max at mascanc.net
Tue May 9 05:18:18 EDT 2017
Hi All,
Again me, sorry, but the migration to OpenSAMLV3.3.0 is creating some troubles,
and probably I’m doing some very bad things.
The SAMLSignatureProfileValidator fails because the ID is not registered.
Line 156 uses the deprecated getElementByID from IdResolver that, in xmlsec version 2.0.5 (used by shibboleth) and 2.0.8 is of course calling org.w3.dom.DeferredDocumentImpl.getElementById. which returns null, obtaining
11:08:30.910 [main] ERROR o.o.s.s.i.SAMLSignatureProfileValidator - Apache xmlsec IdResolver could not resolve the Element for id reference: _f851e9ff-aa45-4a60-9719-55730344c52e
(note that the element is there as you can see from the attached SOAP). Using this code, the id is resolved:
Assertion assertion = SoapUtils.createSaml(localcert, localkey);
String id = assertion.getID();
Element assertionElement = SAML2Utilities.toElement(assertion);
Element idEleme = IdResolver.getElementById(assertionElement.getOwnerDocument(), id);
assertionElement.setIdAttribute("ID", true);
Element idEleme2 = IdResolver.getElementById(assertionElement.getOwnerDocument(), id);
The first idEleme is null, the second is not null. In order to make it working, I’ve to manually register the ID element in the toElement method (which is easy as it can be, see inline).
Worthless to say that this code was working perfectly in OpenSAML 2.6.1. Any ideas?
Did I do some obvious mistakes?
Thanks a LOT!
Marshaller marshaller = marshallerFactory.getMarshaller(a);
Element assertionElement = null;
try {
assertionElement = marshaller.marshall(a);
assertionElement.setIdAttribute("ID", true);
return assertionElement;
} catch (Throwable e1) {
e1.printStackTrace();
throw new GeneralSAMLException("Unable to marshall the assertion: " + e1.getMessage(), e1);
}
The attached SOAP.
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope">
<s:Header>
<wsse:Security s:mustUnderstand="true" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">
<saml2:Assertion ID="_f851e9ff-aa45-4a60-9719-55730344c52e" IssueInstant="2017-05-09T09:07:27.513Z" Version="2.0" xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">
<saml2:Issuer Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified">Issuer</saml2:Issuer>
<ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
<ds:SignedInfo>
<ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
<ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
<ds:Reference URI="#_f851e9ff-aa45-4a60-9719-55730344c52e">
<ds:Transforms>
<ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
<ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
</ds:Transforms>
<ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
<ds:DigestValue>wrkpFgSlV78Jy2tnnt/6SHhIyrRSKyl9RF5I0351RXE=</ds:DigestValue>
</ds:Reference>
</ds:SignedInfo>
<ds:SignatureValue>
sDrB94mJj5nBvLXs+++6yoj5GMNXHEGYUCV073tht4/XMUinA7FZqj15zXvVlFpHx+COB+C2IRO8
b7BOanxZiQpYoKWwQM8QEeCIHls63wQ+tLr9v/GSH0iHjIR681R6cWAY1HsowcKiuvwQ1sVq4tAE
eL3yMR9JTqxZcG5nr7k=
</ds:SignatureValue>
<ds:KeyInfo>
<ds:X509Data>
<ds:X509Certificate>MIICTzCCAbigAwIBAgICARswDQYJKoZIhvcNAQENBQAwOjELMAkGA1UEBhMCRlIxEzARBgNVBAoMCklIRSBFdXJvcGUxFjAUBgNVBAMMDUlIRSBFdXJvcGUgQ0EwHhcNMTQwMzA2MTQzNDA5WhcNMjQwMzA2MTQzNDA5WjCBnzELMAkGA1UEBhMCQVQxFTATBgNVBAoMDFRpYW5pIFNwaXJpdDESMBAGA1UEAwwJVGlhbmkgRUhSMRUwEwYDVQQqDAxNYXNzaW1pbGlhbm8xDTALBgNVBAUTBE1hc2kxGDAWBgNVBAsMD0NBVCBWaWVubmEgMjAxNDElMCMGCSqGSIb3DQEJARYWbWFzc2lAdGlhbmktc3Bpcml0LmNvbTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAzc8nsEePV9CwT25cR99EM/EDh7w/0KgG/InSWFNIIIUMw/dx6pDVZhPw8w3G4GfllT5w1dw//plkI1HWPlrsxcoHpAxor0AUMxpW4TZFht5q8dSZkNjJTJOwZd7SEx71brO0wQ5+uNsfjBuSIyecpH+DfPqpi9Hw6a9l6qMOiL0CAwEAATANBgkqhkiG9w0BAQ0FAAOBgQAYRZgUu1QADeLr2E0DFvwv2zQ1Erv2f9uUzeyvKXjuvrU17XgNu8YJxWquuffchhR6DYKIoIKpo/Dbc296AlYOEvLqhHmkjt9t2v+Mx51HYgUF1kI0M7lbDKEeW7Rdm5jenFVm4eYCQCj3Mcwy4RNMnAMXu+Kr4YGW0n1EcgffSQ==</ds:X509Certificate>
<ds:X509SubjectName>EMAILADDRESS=massi</ds:X509SubjectName>
<ds:X509IssuerSerial>
<ds:X509IssuerName>CN=CA</ds:X509IssuerName>
<ds:X509SerialNumber>283</ds:X509SerialNumber>
</ds:X509IssuerSerial>
</ds:X509Data>
</ds:KeyInfo>
</ds:Signature>
<saml2:Subject>
<saml2:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified">Username</saml2:NameID>
<saml2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:holder-of-key">
<saml2:SubjectConfirmationData>
<ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
<ds:X509Data>
<ds:X509Certificate>MIICTzCCAbigAwIBAgICARswDQYJKoZIhvcNAQENBQAwOjELMAkGA1UEBhMCRlIxEzARBgNVBAoMCklIRSBFdXJvcGUxFjAUBgNVBAMMDUlIRSBFdXJvcGUgQ0EwHhcNMTQwMzA2MTQzNDA5WhcNMjQwMzA2MTQzNDA5WjCBnzELMAkGA1UEBhMCQVQxFTATBgNVBAoMDFRpYW5pIFNwaXJpdDESMBAGA1UEAwwJVGlhbmkgRUhSMRUwEwYDVQQqDAxNYXNzaW1pbGlhbm8xDTALBgNVBAUTBE1hc2kxGDAWBgNVBAsMD0NBVCBWaWVubmEgMjAxNDElMCMGCSqGSIb3DQEJARYWbWFzc2lAdGlhbmktc3Bpcml0LmNvbTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAzc8nsEePV9CwT25cR99EM/EDh7w/0KgG/InSWFNIIIUMw/dx6pDVZhPw8w3G4GfllT5w1dw//plkI1HWPlrsxcoHpAxor0AUMxpW4TZFht5q8dSZkNjJTJOwZd7SEx71brO0wQ5+uNsfjBuSIyecpH+DfPqpi9Hw6a9l6qMOiL0CAwEAATANBgkqhkiG9w0BAQ0FAAOBgQAYRZgUu1QADeLr2E0DFvwv2zQ1Erv2f9uUzeyvKXjuvrU17XgNu8YJxWquuffchhR6DYKIoIKpo/Dbc296AlYOEvLqhHmkjt9t2v+Mx51HYgUF1kI0M7lbDKEeW7Rdm5jenFVm4eYCQCj3Mcwy4RNMnAMXu+Kr4YGW0n1EcgffSQ==</ds:X509Certificate>
<ds:X509SubjectName>EMAILADDRESS=massi</ds:X509SubjectName>
<ds:X509IssuerSerial>
<ds:X509IssuerName>CN=CA</ds:X509IssuerName>
<ds:X509SerialNumber>283</ds:X509SerialNumber>
</ds:X509IssuerSerial>
</ds:X509Data>
</ds:KeyInfo>
</saml2:SubjectConfirmationData>
</saml2:SubjectConfirmation>
</saml2:Subject>
<saml2:Conditions NotBefore="2017-05-09T09:07:27.513Z" NotOnOrAfter="2017-05-09T14:07:27.513Z"/>
<saml2:AuthnStatement AuthnInstant="2017-05-09T09:07:27.513Z" SessionIndex="123456" SessionNotOnOrAfter="2017-05-09T14:07:27.513Z">
<saml2:AuthnContext>
<saml2:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:Password</saml2:AuthnContextClassRef>
</saml2:AuthnContext>
</saml2:AuthnStatement>
</saml2:Assertion>
</wsse:Security>
</s:Header>
<s:Body>
<ns1:sampleValue xmlns:ns1="urn:tiani-spirit:test">
this is a value
</ns1:sampleValue>
</s:Body>
</s:Envelope>
--
Anger is a gift, http://www.mascanc.net/
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20170509/86cecbd8/attachment-0001.html>
More information about the dev
mailing list