How to sign Timestamp

Wed Mar 13 08:47:36 EDT 2019

Good morning,

I'm trying to do the same thing as you are here, and this post has helped
greatly.  Currently, I'm getting an error in the signObject() call that the
signature cannot find the timestamp ID.  I'm hoping you can share how you
solved your issue yourself, it would be very helpful to me.  I'm guessing
the error is somewhere in how I'm marshalling the elements, but I'm not sure
on that.  Opensaml is new to me, although I am successful with the enveloped
signature in the assertion that I'm creating.

Here is the error I'm getting:

org.opensaml.xml.signature.Signer:signObject(78): An error occured computing
the digital signature
org.apache.xml.security.signature.ReferenceNotInitializedException: Cannot
resolve element with ID _0

Here is how I'm building the signature:

XMLObjectBuilderFactory builderFactory;
            DefaultBootstrap.bootstrap();
            builderFactory = Configuration.getBuilderFactory();

            Security secRoot = (Security)
builderFactory.getBuilder(Security.ELEMENT_NAME).buildObject(Security.ELEMENT_NAME);            

            DateTime nowDateTime = new DateTime();
            Created created = (Created)
builderFactory.getBuilder(Created.ELEMENT_NAME).buildObject(Created.ELEMENT_NAME);
            created.setDateTime(nowDateTime);
            Expires expires = (Expires)
builderFactory.getBuilder(Expires.ELEMENT_NAME).buildObject(Expires.ELEMENT_NAME);
            expires.setDateTime(nowDateTime.plusMinutes(5));

            Timestamp timeStampSigned = (Timestamp)
builderFactory.getBuilder(Timestamp.ELEMENT_NAME).buildObject(Timestamp.ELEMENT_NAME);            
            timeStampSigned.setCreated(created);
            timeStampSigned.setExpires(expires);
            timeStampSigned.setWSUId("_0");

            secRoot.getUnknownXMLObjects().add(timeStampSigned);

            Signature signature = (Signature)
builderFactory.getBuilder(Signature.DEFAULT_ELEMENT_NAME).buildObject(Signature.DEFAULT_ELEMENT_NAME);

            DocumentInternalIDContentReference reference = new
DocumentInternalIDContentReference(timeStampSigned.getWSUId()); // we always
set "_0" as the timestamp id

reference.getTransforms().add(SignatureConstants.TRANSFORM_C14N_EXCL_OMIT_COMMENTS);

reference.setDigestAlgorithm(SignatureConstants.ALGO_ID_DIGEST_SHA1);            
            signature.getContentReferences().add(reference);

            KeyInfoBuilder keyInfoBuilder = (KeyInfoBuilder)
builderFactory.getBuilder(KeyInfo.DEFAULT_ELEMENT_NAME);
            KeyInfo keyInfo = (KeyInfo) keyInfoBuilder.buildObject();

            SecurityTokenReference secRef = (SecurityTokenReference)
builderFactory.getBuilder(SecurityTokenReference.ELEMENT_NAME).buildObject(SecurityTokenReference.ELEMENT_NAME);
            KeyIdentifier keyIdentifier = (KeyIdentifier)
builderFactory.getBuilder(KeyIdentifier.ELEMENT_NAME).buildObject(KeyIdentifier.ELEMENT_NAME);

keyIdentifier.setValueType("http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID");

keyIdentifier.setValue(this.assertionElement.getAttribute("ID"));
            secRef.getUnknownXMLObjects().add(keyIdentifier);

            keyInfo.getXMLObjects().add(secRef);
            signature.setKeyInfo(keyInfo);

            BasicX509Credential credential = new BasicX509Credential();
            credential.setEntityCertificate(x509Cert);            
            credential.setPrivateKey(this.privateKey);
            signature.setSigningCredential(credential);

signature.setSignatureAlgorithm(SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA1);

signature.setCanonicalizationAlgorithm(SignatureConstants.TRANSFORM_C14N_EXCL_OMIT_COMMENTS);

            secRoot.getUnknownXMLObjects().add(timeStampSigned);
            secRoot.getUnknownXMLObjects().add(signature);

            Marshaller marshaller =
Configuration.getMarshallerFactory().getMarshaller(timeStampSigned);
            Element signedStamp = marshaller.marshall(timeStampSigned);
            Marshaller sigMarshaller =
Configuration.getMarshallerFactory().getMarshaller(signature);
            sigMarshaller.marshall(signature);
            Marshaller rootMarshaller =
Configuration.getMarshallerFactory().getMarshaller(secRoot);
            rootMarshaller.marshall(secRoot);            

            LOGGER.debug("full security element after marshalling:");
            LOGGER.debug(XMLHelper.nodeToString(secRoot.getDOM()));            

            Signer.signObject(signature);

And here is the XML after marshalling, but before signing:

<?xml version="1.0" encoding="UTF-8"?>
<wsse:Security
xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">
	<wsu:Timestamp
xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"
wsu:Id="_0">
		<wsu:Created>2019-03-13T12:30:56.034Z</wsu:Created>
		<wsu:Expires>2019-03-13T12:35:56.034Z</wsu:Expires>
	</wsu:Timestamp>
	<ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
		<ds:SignedInfo>
			<ds:CanonicalizationMethod
Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
			<ds:SignatureMethod
Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
			<ds:Reference URI="#_0">
				<ds:Transforms>
					<ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
				</ds:Transforms>
				<ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
				<ds:DigestValue/>
			</ds:Reference>
		</ds:SignedInfo>
		<ds:SignatureValue/>
		<ds:KeyInfo>
			<wsse:SecurityTokenReference
xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">
				<wsse:KeyIdentifier
ValueType="http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID">_46577b5a-a650-5ea6-8d18-4ebdfb448482</wsse:KeyIdentifier>
			</wsse:SecurityTokenReference>
		</ds:KeyInfo>
	</ds:Signature>
</wsse:Security>

--
Sent from: http://shibboleth.1660669.n2.nabble.com/Shibboleth-Developers-f1660781.html