OpenSAML v3 signing and validating SAML Objects

[Brent Putman]

On 4/24/20 6:35 AM, Paul Statham wrote:
> Hi,
>
> I have created a simple SOAP service which will accept an 
> AttributeQuery SAML element in the body of a SOAP envelope. This 
> works fine, I am now moving on to validating a signed AttributeQuery. 
> To do this I have created a simple integration test to build an 
> attribute query, sign it and use a soap client to send the request.
>
> The signing is done like so


I don't see any issues with signing and validation code itself.


>
>
> The validation is failing, it seems that the decoded digest value is 
> different from the computed digest value, and I can't for the life of 
> me see why. Any ideas? Here's a sample soap envelope sent as a request.
>

That error pretty much means what it says.  The bytes that you are 
validating are not the same bytes that were signed.  Something is 
changing the document between signing and validation, for example how 
you are serializing and then deserializing/parsing it.  For example, 
pretty printing or adding/removing a single whitespace character will 
invalidate the signature.

We have some signature troubleshooting docs here (it's the v2 wiki 
space, but the info is the same for 3 and 4):

https://wiki.shibboleth.net/confluence/display/OpenSAML/OSTwoUserManSigErrors

Pay attention to #3, but especially #5.  That gives you the details on 
how to get logging on what you have signed vs what you are validating.  
Figure out the delta(s) between them and then go from there.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20200424/4f10c7c1/attachment.html>