OpenSAML v3 signing and validating SAML Objects

[Paul Statham]

Hmmm yeah I pretty much came to the same conclusion. I think I know why as
well. As I'm using spring ws it uses jaxb for marshaling and unmarshaling,
as a result I'm converting between opensaml objects and jaxb objects.

I may look into spring ws doing the signing instead of opensaml.

Thanks
Paul

On Fri, 24 Apr 2020, 22:44 Brent Putman, <putmanb at georgetown.edu> wrote:

>
> On 4/24/20 6:35 AM, Paul Statham wrote:
>
> Hi,
>
> I have created a simple SOAP service which will accept an AttributeQuery
> SAML element in the body of a SOAP envelope. This works fine, I am now
> moving on to validating a signed AttributeQuery. To do this I have created
> a simple integration test to build an attribute query, sign it and use a
> soap client to send the request.
>
> The signing is done like so
>
>
> I don't see any issues with signing and validation code itself.
>
>
>
>
> The validation is failing, it seems that the decoded digest value is
> different from the computed digest value, and I can't for the life of me
> see why. Any ideas? Here's a sample soap envelope sent as a request.
>
>
> That error pretty much means what it says.  The bytes that you are
> validating are not the same bytes that were signed.  Something is changing
> the document between signing and validation, for example how you are
> serializing and then deserializing/parsing it.  For example, pretty
> printing or adding/removing a single whitespace character will invalidate
> the signature.
>
> We have some signature troubleshooting docs here (it's the v2 wiki space,
> but the info is the same for 3 and 4):
>
>
> https://wiki.shibboleth.net/confluence/display/OpenSAML/OSTwoUserManSigErrors
>
> Pay attention to #3, but especially #5.  That gives you the details on how
> to get logging on what you have signed vs what you are validating.  Figure
> out the delta(s) between them and then go from there.
>
>
> --
> To unsubscribe from this list send an email to
> dev-unsubscribe at shibboleth.net
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20200425/f64a7dee/attachment.html>