Issue validating SAML signature

[Eze Ikonne]

Hi Brent,

Thanks so very much, I will follow up on your suggestions.

Ike

From: dev [mailto:dev-bounces at shibboleth.net] On Behalf Of Brent Putman
Sent: Monday, January 7, 2019 5:21 PM
To: dev at shibboleth.net
Subject: Re: Issue validating SAML signature

** This mail has been sent from an external source **



On 1/5/19 11:49 PM, Eze Ikonne wrote:

Hi all,

I am not sure if  this the right forum for the issue that I having,



Yes, this list (the Shibboleth developer's list) is the right place.


I have upgraded to  opensaml3 downloaded from shibboleth. My application is a service provider and I am trying to validate Saml Response from an IDP  that has a signed Assertion.


                BasicX509Credential cred = new BasicX509Credential();
                  cred.setEntityCertificate(matchedCert);
                  cred.setPublicKey(matchedCert.getPublicKey());
                  cred.setCRLs(null);

            try {
                SignatureValidator signatureValidator = new SignatureValidator(cred);
                signatureValidator.validate(sig);
                return true;
              } catch (ValidationException ex) {
                    ex.printStackTrace();
                System.out.println("******** signature validation failed");
              }





I don't see anything fundamentally wrong with that code.  It should work, for valid signature and credential inputs.

(For the record, there are other better ways using higher-level components to do signature validation for real-world use cases, using TrustEngine(s) and credentials resolved from SAML metadata.  Those are pretty much mandatory if you have to deal with multiple SAML peers.  But none of that is relevant to your problem.)


But I keep getting the following stacktrace ...

2019-01-03 21:21:03,857 [Service-0] DEBUG systemout - org.opensaml.xml.validation.ValidationException: Signature did not validate against the credential's key
2019-01-03 21:21:03,858 [Service-0] DEBUG systemout -               at org.opensaml.xml.signature.SignatureValidator.validate(SignatureValidator.java:78)
2019-01-03 21:21:03,858 [Service-0] DEBUG systemout -               at com.sterlingcommerce.component.token.saml.SimpleSamlTokenManager.verifySAMLSignature(SimpleSamlTokenManager.java:482)
2019-01-03 21:21:03,858 [Service-0] DEBUG systemout -               at com.sterlingcommerce.component.token.saml.SimpleSamlTokenManager.validateAssertionSignature(SimpleSamlTokenManager.java:370)
2019-01-03 21:21:03,859 [Service-0] DEBUG systemout -               at com.sterlingcommerce.component.token.saml.SimpleSamlTokenManager.validateSignature(SimpleSamlTokenManager.java:333)
2019-01-03 21:21:03,859 [Service-0] DEBUG systemout -               at com.sterlingcommerce.component.token.saml.SimpleSamlTokenManager.verifySamlAuthenticationResponse(SimpleSamlTokenManager.java:300)
2019-01-03 21:21:03,859 [Service-0] DEBUG systemout -               at com.sterlingcommerce.component.sso.impl.SingleSignonServiceImpl.samlTokenVerify(SingleSignonServiceImpl.java:749)
2019-01-03 21:21:03,859 [Service-0] DEBUG systemout -               at com.sterlingcommerce.component.sso.impl.SingleSignonServiceImpl$RequestListener$8.run(SingleSignonServiceImpl.java:1790)
2019-01-03 21:21:03,860 [Service-0] DEBUG systemout -               at EDU.oswego.cs.dl.util.concurrent.PooledExecutor$Worker.run(PooledExecutor.java:727)
2019-01-03 21:21:03,860 [Service-0] DEBUG systemout -               at java.lang.Thread.run(Thread.java:811)


I would appreciate it if anyone could point me to the right solution or maybe point out what my code is doing wrong. I have tried to run sample codes around this issue, but I have still to get any of the signature validation to be successful. Any help or suggestions would be greatly appreciated.




Your code itself isn't wrong.  So the most likely explanations are: 1) the certificate/public key with which you're trying to validate is not the correct one 2) you're corrupting the XML you receive before validating it 3) the signer (IdP) has a bug and is generating an invalid signature.  Unless the IdP is somebody's one-off and isn't a known good XML signature implementation, given our past experience #1 is far and away the most likely issue (like 90%+ probability).  If you've already double-checked it, then triple- and quadruple-check it.  Most people swear that is not the problem, up to the moment they figure out that it is...

You may find this page in our wiki helpful.  It's still homed in the OpenSAML v2 section, but ignore the warning about the old version.  All the info there is still relevant to v3.

https://wiki.shibboleth.net/confluence/display/OpenSAML/OSTwoUserManSigErrors



Thanks,
Brent



=====================================================
Please refer to http://www.aricent.com/email-disclaimer
for important disclosures regarding this electronic communication.
=====================================================
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20190108/60749313/attachment.html>