OpenSAML v3 signing and validating SAML Objects

[Paul Statham]

Hi,

Sorry done a bit more digging around the Spring WS signing the response. So
it appears to add a security header to the soap header of the enveloped
response. This references the SAML elements within the body. Is this valid
from a SAML 2.0 SOAP binding perspective?

Thanks,

Paul

On Sat, Apr 25, 2020 at 8:37 AM Paul Statham <paul.statham81 at gmail.com>
wrote:

> Hmmm yeah I pretty much came to the same conclusion. I think I know why as
> well. As I'm using spring ws it uses jaxb for marshaling and unmarshaling,
> as a result I'm converting between opensaml objects and jaxb objects.
>
> I may look into spring ws doing the signing instead of opensaml.
>
> Thanks
> Paul
>
> On Fri, 24 Apr 2020, 22:44 Brent Putman, <putmanb at georgetown.edu> wrote:
>
>>
>> On 4/24/20 6:35 AM, Paul Statham wrote:
>>
>> Hi,
>>
>> I have created a simple SOAP service which will accept an AttributeQuery
>> SAML element in the body of a SOAP envelope. This works fine, I am now
>> moving on to validating a signed AttributeQuery. To do this I have created
>> a simple integration test to build an attribute query, sign it and use a
>> soap client to send the request.
>>
>> The signing is done like so
>>
>>
>> I don't see any issues with signing and validation code itself.
>>
>>
>>
>>
>> The validation is failing, it seems that the decoded digest value is
>> different from the computed digest value, and I can't for the life of me
>> see why. Any ideas? Here's a sample soap envelope sent as a request.
>>
>>
>> That error pretty much means what it says.  The bytes that you are
>> validating are not the same bytes that were signed.  Something is changing
>> the document between signing and validation, for example how you are
>> serializing and then deserializing/parsing it.  For example, pretty
>> printing or adding/removing a single whitespace character will invalidate
>> the signature.
>>
>> We have some signature troubleshooting docs here (it's the v2 wiki space,
>> but the info is the same for 3 and 4):
>>
>>
>> https://wiki.shibboleth.net/confluence/display/OpenSAML/OSTwoUserManSigErrors
>>
>> Pay attention to #3, but especially #5.  That gives you the details on
>> how to get logging on what you have signed vs what you are validating.
>> Figure out the delta(s) between them and then go from there.
>>
>>
>> --
>> To unsubscribe from this list send an email to
>> dev-unsubscribe at shibboleth.net
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20200427/b87e8af2/attachment.html>