OpenSAML 3.4.1 saml2p:Response SignatureValue contains encoded CRs

[Brent Putman]

On 8/13/21 5:31 PM, Ivaylo Milev wrote:
>
> Hi guys,
>
> I am trying to get OpenSAML to generate a saml2p:Response without any 
> line breaks, especially in the SignatureValue.
>
> I have tried providing the 
> -Dorg.apache.xml.security.ignoreLineBreaks=true option to the JVM,


That is the correct option.  That option is implemented by one of our 
dependencies, the Santuario XML Security library, not by us. So it 
either works or it doesn't. If it doesn't, you'd probably have to take 
it up with the Santuario project, we really couldn't do anything about it.

For the record OpenSAML attempts to programmatically set that system 
property by default (if not otherwise set), but it won't always work 
because of potential variances in Java classloading. They init that in 
a static var in their class, so if that gets loaded before our code has 
a change to run, it won't get set.  So it's just a best effort to try 
and set it.  Setting it as an arg to the JVM should always work though, 
as far as it being visible to the Santuario class.

However....


> but the output generated by OpenSAML 3.4.1 still includes the encoded 
> carriage return in the SignatureValue.


3.x is unsupported at this point, and even worse 3.4.1 is many years 
old.  I have no idea what issues there may be around this on such an 
old version, that includes an old version of Santuario. As you can tell 
from the issue you posted, there were some changes they made there at 
some point that broke things.  I don't remember the entire history. You 
could try updating to a newer version of 3.x (at the very least) and/or 
munging the dependencies to a newer version of Santuario.

I can confirm that the system property does work correctly to eliminate 
line breaks in the latest OpenSAML 4.x.


>
> I know xml dig signature processors *should* be able to deal with /n 
> and /r/n cases, but I have a .NET client using Sustainsys2 that is 
> broken.


I'm sympathetic, but ultimately you're dealing with broken software on 
the other side, and there's only so much you can expect libraries like 
OpenSAML and Santuario to do to help you out.  Have you tried reporting 
the bug to the project or service that maintains the consuming software?


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20210816/0380eac9/attachment.htm>