OpenSAML 3.4.1 saml2p:Response SignatureValue contains encoded CRs

[Ivaylo Milev]

Thanks, Brent!

I'll certainly look into upgrading to OpenSAML 4.x. I have reported the
issue to the Sustainsys2 team - and if I find the time, I'll send them a PR.

Regards,
Ivaylo


On Mon, Aug 16, 2021 at 10:19 PM Brent Putman <putmanb at georgetown.edu>
wrote:

>
> On 8/13/21 5:31 PM, Ivaylo Milev wrote:
>
>
> Hi guys,
>
> I am trying to get OpenSAML to generate a saml2p:Response without any line
> breaks, especially in the SignatureValue.
>
> I have tried providing the -Dorg.apache.xml.security.ignoreLineBreaks=true
> option to the JVM,
>
>
> That is the correct option.  That option is implemented by one of our
> dependencies, the Santuario XML Security library, not by us.  So it either
> works or it doesn't. If it doesn't, you'd probably have to take it up with
> the Santuario project, we really couldn't do anything about it.
>
> For the record OpenSAML attempts to programmatically set that system
> property by default (if not otherwise set), but it won't always work
> because of potential variances in Java classloading.  They init that in a
> static var in their class, so if that gets loaded before our code has a
> change to run, it won't get set.  So it's just a best effort to try and set
> it.  Setting it as an arg to the JVM should always work though, as far as
> it being visible to the Santuario class.
>
> However....
>
>
> but the output generated by OpenSAML 3.4.1 still includes the encoded
> carriage return in the SignatureValue.
>
>
> 3.x is unsupported at this point, and even worse 3.4.1 is many years old.
> I have no idea what issues there may be around this on such an old version,
> that includes an old version of Santuario.  As you can tell from the issue
> you posted, there were some changes they made there at some point that
> broke things.  I don't remember the entire history. You could try updating
> to a newer version of 3.x (at the very least) and/or munging the
> dependencies to a newer version of Santuario.
>
> I can confirm that the system property does work correctly to eliminate
> line breaks in the latest OpenSAML 4.x.
>
>
>
> I know xml dig signature processors *should* be able to deal with /n and
> /r/n cases, but I have a .NET client using Sustainsys2 that is broken.
>
>
> I'm sympathetic, but ultimately you're dealing with broken software on the
> other side, and there's only so much you can expect libraries like OpenSAML
> and Santuario to do to help you out.  Have you tried reporting the bug to
> the project or service that maintains the consuming software?
>
> --
> To unsubscribe from this list send an email to
> dev-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20210817/403db057/attachment.htm>