Issue validating SAML signature

[Eze Ikonne]

Hi all,

I am not sure if  this the right forum for the issue that I having, I have upgraded to  opensaml3 downloaded from shibboleth. My application is a service provider and I am trying to validate Saml Response from an IDP  that has a signed Assertion.
I have the IDP public x509 in my keystore, and that is the only certificate in that keystore. I could see that the embedded x509data in the assertion matches the public certificate of the IDP in my keystore and yet I am not able to verify the digital signature. Here is the logic that I am using

                BasicX509Credential cred = new BasicX509Credential();
                  cred.setEntityCertificate(matchedCert);
                  cred.setPublicKey(matchedCert.getPublicKey());
                  cred.setCRLs(null);

            try {
                SignatureValidator signatureValidator = new SignatureValidator(cred);
                signatureValidator.validate(sig);
                return true;
              } catch (ValidationException ex) {
                    ex.printStackTrace();
                System.out.println("******** signature validation failed");
              }


But I keep getting the following stacktrace ...

2019-01-03 21:21:03,857 [Service-0] DEBUG systemout - org.opensaml.xml.validation.ValidationException: Signature did not validate against the credential's key
2019-01-03 21:21:03,858 [Service-0] DEBUG systemout -               at org.opensaml.xml.signature.SignatureValidator.validate(SignatureValidator.java:78)
2019-01-03 21:21:03,858 [Service-0] DEBUG systemout -               at com.sterlingcommerce.component.token.saml.SimpleSamlTokenManager.verifySAMLSignature(SimpleSamlTokenManager.java:482)
2019-01-03 21:21:03,858 [Service-0] DEBUG systemout -               at com.sterlingcommerce.component.token.saml.SimpleSamlTokenManager.validateAssertionSignature(SimpleSamlTokenManager.java:370)
2019-01-03 21:21:03,859 [Service-0] DEBUG systemout -               at com.sterlingcommerce.component.token.saml.SimpleSamlTokenManager.validateSignature(SimpleSamlTokenManager.java:333)
2019-01-03 21:21:03,859 [Service-0] DEBUG systemout -               at com.sterlingcommerce.component.token.saml.SimpleSamlTokenManager.verifySamlAuthenticationResponse(SimpleSamlTokenManager.java:300)
2019-01-03 21:21:03,859 [Service-0] DEBUG systemout -               at com.sterlingcommerce.component.sso.impl.SingleSignonServiceImpl.samlTokenVerify(SingleSignonServiceImpl.java:749)
2019-01-03 21:21:03,859 [Service-0] DEBUG systemout -               at com.sterlingcommerce.component.sso.impl.SingleSignonServiceImpl$RequestListener$8.run(SingleSignonServiceImpl.java:1790)
2019-01-03 21:21:03,860 [Service-0] DEBUG systemout -               at EDU.oswego.cs.dl.util.concurrent.PooledExecutor$Worker.run(PooledExecutor.java:727)
2019-01-03 21:21:03,860 [Service-0] DEBUG systemout -               at java.lang.Thread.run(Thread.java:811)


I would appreciate it if anyone could point me to the right solution or maybe point out what my code is doing wrong. I have tried to run sample codes around this issue, but I have still to get any of the signature validation to be successful. Any help or suggestions would be greatly appreciated.


Thanks,


=====================================================
Please refer to http://www.aricent.com/email-disclaimer
for important disclosures regarding this electronic communication.
=====================================================
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20190106/a81f2cab/attachment.html>