How to sign Timestamp

[Brent Putman]

On 10/30/18 9:11 PM, Binh Pham wrote:
> It throws the exception "Unable to compute signature, Signature
> XMLObject does not have the XMLSignature created during marshalling."
> when I call Signer.signObject(signature);

Like all the XML signing in OpenSAML, you have to marshall the
object(s) first.  That's because the signing is done at the DOM level
by the Apache Santuario library that we use for XML signing (and
encryption).



> So the Timestamp will be a child of Security.

Yes, but...

> The Security is not a SignableXMLObject.

True, but completely irrelevant.  The SignableXMLObject and
SignableSAMLObject are only applicable for Enveloped signature cases. 
They are not relevant for Detached and Enveloping cases.


> I am wondering if I have to create a SignableXMLObject class and add
> Timestamp as a child and try to sign from there.


No, absolutely not.  Just be sure to marshall the Signature and
Timestamp objects before you call Signer.signObject.

When you get around to doing the Assertion signature, same thing, you
must marshall the Assertion before Signer.signObject.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20181030/b3debed2/attachment-0001.html>