How to sign Timestamp

[Brent Putman]

On 10/29/18 4:47 PM, Binh Pham wrote:
>
>
> I need to sign the timestamp and assertion in the SAML token using
> OpenSAML v3.

Sounds like your use case is WS-Security and possibly other WS-* friends?

> The assertion inherits from SignableSAMLObject so I can attach a
> signature object to sign.

Yes, but that is specifically for Enveloped signature, not all possible
XML signature use cases (e.g. Detached or Enveloping).  Enveloped is the
common use case for Assertions in SAML profiles (SSO, etc), but with
WS-* I have no idea about what you are trying to do.

> Timestamp, however is not.

Correct.  It typically would not have an Enveloped signature, doesn't
make much sense.  In fact it may be literally impossible, based on the
schema.

> How do I sign Timestamp for this case before attach the security
> element to the SOAP header?

WS-Security and the other WS-* specs are not really implementable by
themselves.  They are more building blocks with which to assemble
profiles that can then be implemented.  So you really will have to be
much more specific in what you are trying to do.

Ideally you are implementing an existing SOAP profile that is concretely
well-defined ... (pauses for laughter) ... but if not, then you at the
very least need to know *exactly* what you are trying to do. The
OpenSAML library will not hold your hand much in this, unfortunately. 
The SOAP support is pretty low-level.

There are multiple possible variants, such as whether the Assertion is
signed or not with an Enveloped signature (so that it is effectively
usable as a standalone security token - which if so also leads to a
myriad of issues with subject confirmation, conditions, etc.), and then
what the WS-Security signature will "cover" - presumably it will be a
Detached one over the Assertion and the Timestamp and possibly other
things.  But basically it all boils down to what you specify as the
signature's content reference(s).


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20181029/b36c721f/attachment.html>