How to sign Timestamp

[Brent Putman]

On 10/30/18 8:35 AM, Binh Pham wrote:
> I am trying to implement the NHIN SAML specs
> (https://sequoiaproject.org/wp-content/uploads/2014/11/nhin-authorization-framework-production-specification-v3.0.pdf)
> which the SAML token will appear in the header of the SOAP envelope
> for each request.

Ok.  It's good that you have a concrete spec here.


> In this specs, there are two parts to the token which are the
> timestamp and an assertion. I need to sign the timestamp and the
> assertion. I don't see there is a way to sign the timestamp with the
> current version (v3) of the library.
Looks like for the Assertion it does want a standard Enveloped
signature, which is fine and easy.

In the spec in Figure 3.2-1 and in the text in section 3.1.2, it
illustrates that the Timestamp signature is a (second, separate)
Detached signature, not Enveloped.  The Signature element will be a
peer of the Timestamp element, not a child as with Enveloped.

Virtually anything can be signed with a Detached signature, esp (as
here) if it's in the same document as the signature and carries an ID
attribute. For that case in OpenSAML you use the
DocumentInternalIDContentReference impl of ContentReference, with the
ID value supplied to the constructor being that of the Timestamp.  And
then add that to the List<ContentReference> of the Signature.  That's
really the only significant difference from the Enveloped signature
cases via SignableXMLObject and SignableSAMLObject (where the latter
adds a SAMLObjectContentReference automatically).
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20181030/95610e59/attachment-0001.html>