How to sign Timestamp

[Binh Pham]

You can ignore the question above about signature value and digest value
being empty. I found the errors of my way. I had backward between signature
and timestamp when I marshal those 2 objects.

The only question I have left is there away to tell the signature object to
don't break the signature value block into multiple line?
At the end of each line, it has "
" by default. I was wondering if that
would affect the validation anyhow.
This is my signature value looks like
<ds:SignatureValue>
clwPq0HLw9AGxYqEE4/wi+wGoBTIGiUl8TbiTin8y9Z5OkvZEDgiLDRt6C0B0ZMUmgpI3+ZoEW6e&#xd;
Wpd+GEttEbmw7+IQYjH1OcVBQoLy2R/IGuAclb1Xir9yFncdkN9t20h7nsYURM8UkfkN4izmQ3yo&#xd;
PwsYKmdan4zD0eIm/LMWHOZjmBay2G75i1epXogBXmjnrE77Vwl+4lScU4F458aTOdJA61cYa6qh&#xd;
sThcFeZ/kXG5cgm6r+yhgleRfCuCvLML/zJU/P+rb3hkXw8z7f9VBAHmBUvZFys/9Otur0WqVrYA&#xd;
0loxXHgJ4ukqdKGFX/9b1tQrNRr3iIUAhgc96jqxGYKKTqYRv8P9rD9y835EZXLfm4tbP9LXBALT&#xd;
IVlo4DP8aDGbVymDxGomwjOzofwVN4i1oVC6/MUdTMqw62Za7EQ27OLRpzyhy34T62MrQgWYevut&#xd;
DHDFY6cJJ4blJxZUmko9Pt04VzH+bRL5zsDxUFpmc/+xUr1Ulthk1QiaZ4n75fe+I5pBa/IZu1TC&#xd;
7BJ+5a04qz+Ii5s6QRXgPVXP9ICd1Wfk+sUmS23Y3KujVixprMHgweOGG7e88DlHsI2FSPHNFGSz&#xd;
9Qs0bcDdJ5ACfA/IzTIW0NE/6Enkjt4KynwBj9pW3ETEfBIlgO5f4UDRR538Whb1LWx0F1BXqB0=
</ds:SignatureValue>

On Wed, Oct 31, 2018 at 11:21 AM Binh Pham <btpham at gmail.com> wrote:

> Thank you so much for your patience. I am getting close. I marshal the
> Timestamp and Signature then I was able to sign it. I am trying to get the
> signature value and digest value from the signature but I think I'm in the
> wrong place.
> After calling signObject(signature), I marshal the signature object.
> However, the signature value and digest value are empty. I also marshal the
> Timestamp after signing but nothing there. (I expect this since it's a
> detach signature)
> I added the signature to Security before calling signObject and tried to
> marshal the Security but the signature value is still empty.
> Please let me know where I can retrieve the signature.
>
> On Tue, Oct 30, 2018 at 9:11 PM Binh Pham <btpham at gmail.com> wrote:
>
>> It throws the exception "Unable to compute signature, Signature XMLObject
>> does not have the XMLSignature created during marshalling." when I call
>> Signer.signObject(signature);
>>
>> So the Timestamp will be a child of Security. The Security is not
>> a SignableXMLObject. I am wondering if I have to create a SignableXMLObject
>> class and add Timestamp as a child and try to sign from there. Please let
>> me know if me know if that would be the path to head down. Thanks again for
>> your help.
>>
>>
>>
>> On Tue, Oct 30, 2018 at 5:36 PM Brent Putman <putmanb at georgetown.edu>
>> wrote:
>>
>>>
>>>
>>> On 10/30/18 1:41 PM, Binh Pham wrote:
>>>
>>> Thank you so much for helping thus far. I still have some more questions.
>>>
>>> I would add the timestamp id to DocumentInternalIDContentReference like
>>> so:
>>>
>>> DocumentInternalIDContentReference reference = new
>>> DocumentInternalIDContentReference(timestamp.getWSUId());
>>>
>>> reference.getTransforms().add(SignatureConstants.TRANSFORM_C14N_EXCL_OMIT_COMMENTS);
>>> reference.setDigestAlgorithm(SignatureConstants.ALGO_ID_DIGEST_SHA1);
>>> Signature signature = getSignature(credential);
>>> signature.getContentReferences().add(reference);
>>>
>>>
>>> Offhand, structurally speaking that looks correct to me.
>>>
>>>
>>> Then call Signer.signObject(signature);?
>>>
>>>
>>> Yes.  Other than manually creating and adding the ContentReference,
>>> everything else should be conceptually the same as other XML signatures,
>>> such as the enveloped signature on Assertion.
>>>
>>>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20181031/8aa76d78/attachment.html>