Issue validating SAML signature

[Brent Putman]

On 1/5/19 11:49 PM, Eze Ikonne wrote:
>
>  
>
> Hi all,
>
>  
>
> I am not sure if  this the right forum for the issue that I having,
>

Yes, this list (the Shibboleth developer's list) is the right place.


> I have upgraded to  opensaml3 downloaded from shibboleth. My
> application is a service provider and I am trying to validate Saml
> Response from an IDP  that has a signed Assertion.
>
>
>  
>
>                 BasicX509Credential cred = *new*BasicX509Credential();
>
>                   cred.setEntityCertificate(matchedCert);
>
>                   cred.setPublicKey(matchedCert.getPublicKey());
>
>                   cred.setCRLs(*null*);
>
>                  
>
>             *try*{
>
>                 SignatureValidator signatureValidator =
> *new*SignatureValidator(cred);
>
>                 signatureValidator.validate(sig);
>
>                 *return**true*;
>
>               } *catch*(ValidationException ex) {
>
>                     ex.printStackTrace();
>
>                 System./out/.println("******** signature validation
> failed");
>
>               }
>
>            
>
>  
>

I don't see anything fundamentally wrong with that code.  It should
work, for valid signature and credential inputs.

(For the record, there are other better ways using higher-level
components to do signature validation for real-world use cases, using
TrustEngine(s) and credentials resolved from SAML metadata.  Those are
pretty much mandatory if you have to deal with multiple SAML peers.  But
none of that is relevant to your problem.)


> But I keep getting the following stacktrace …
>
>  
>
> 2019-01-03 21:21:03,857 [Service-0] DEBUG systemout -
> org.opensaml.xml.validation.ValidationException: Signature did not
> validate against the credential's key
>
> 2019-01-03 21:21:03,858 [Service-0] DEBUG systemout -               at
> org.opensaml.xml.signature.SignatureValidator.validate(SignatureValidator.java:78)
>
> 2019-01-03 21:21:03,858 [Service-0] DEBUG systemout -               at
> com.sterlingcommerce.component.token.saml.SimpleSamlTokenManager.verifySAMLSignature(SimpleSamlTokenManager.java:482)
>
> 2019-01-03 21:21:03,858 [Service-0] DEBUG systemout -               at
> com.sterlingcommerce.component.token.saml.SimpleSamlTokenManager.validateAssertionSignature(SimpleSamlTokenManager.java:370)
>
> 2019-01-03 21:21:03,859 [Service-0] DEBUG systemout -               at
> com.sterlingcommerce.component.token.saml.SimpleSamlTokenManager.validateSignature(SimpleSamlTokenManager.java:333)
>
> 2019-01-03 21:21:03,859 [Service-0] DEBUG systemout -               at
> com.sterlingcommerce.component.token.saml.SimpleSamlTokenManager.verifySamlAuthenticationResponse(SimpleSamlTokenManager.java:300)
>
> 2019-01-03 21:21:03,859 [Service-0] DEBUG systemout -               at
> com.sterlingcommerce.component.sso.impl.SingleSignonServiceImpl.samlTokenVerify(SingleSignonServiceImpl.java:749)
>
> 2019-01-03 21:21:03,859 [Service-0] DEBUG systemout -               at
> com.sterlingcommerce.component.sso.impl.SingleSignonServiceImpl$RequestListener$8.run(SingleSignonServiceImpl.java:1790)
>
> 2019-01-03 21:21:03,860 [Service-0] DEBUG systemout -               at
> EDU.oswego.cs.dl.util.concurrent.PooledExecutor$Worker.run(PooledExecutor.java:727)
>
> 2019-01-03 21:21:03,860 [Service-0] DEBUG systemout -               at
> java.lang.Thread.run(Thread.java:811)
>
>  
>
>  
>
> I would appreciate it if anyone could point me to the right solution
> or maybe point out what my code is doing wrong. I have tried to run
> sample codes around this issue, but I have still to get any of the
> signature validation to be successful. Any help or suggestions would
> be greatly appreciated.
>
>

Your code itself isn't wrong.  So the most likely explanations are: 1)
the certificate/public key with which you're trying to validate is not
the correct one 2) you're corrupting the XML you receive before
validating it 3) the signer (IdP) has a bug and is generating an invalid
signature.  Unless the IdP is somebody's one-off and isn't a known good
XML signature implementation, given our past experience #1 is far and
away the most likely issue (like 90%+ probability).  If you've already
double-checked it, then triple- and quadruple-check it.  Most people
swear that is not the problem, up to the moment they figure out that it
is...

You may find this page in our wiki helpful.  It's still homed in the
OpenSAML v2 section, but ignore the warning about the old version.  All
the info there is still relevant to v3.

https://wiki.shibboleth.net/confluence/display/OpenSAML/OSTwoUserManSigErrors


Thanks,
Brent


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20190107/70c9f2b2/attachment.html>