Thanks, Brent. Very helpful. I discovered some of this myself over the weekend, even the URIContentReference stuff, and got it to sign and validate one of my test cases (an XACMLAuthzRequest inside an Envelope). The test case is EnvelopedSignatureTest, renamed SignableSoapEnvelopeTest, and based on SignableSoapEnvelope (below). <br>
<div><br></div><div><br></div><div>Since Envelope lacks a setSignature method I created a wrapper to provide one plus setHeader and setBody methods.</div><div>
<p class="p1"></p><ul><ul><li><span class="s1">public </span><span class="s1">class</span> SignableSoapEnvelope <span class="s1">extends</span> AbstractSignableXMLObject </li><li><span class="s1">implements</span> ElementExtensibleXMLObject, AttributeExtensibleXMLObject</li>
</ul></ul><p></p>
<p class="p1">Is this on the right path? Or should this be AbstractSignableSOAPObject? I'm unclear on the difference so have been exploring both paths. The pointer to ws.wssecurity sounds promising. Have been focusing on xmltooling on the (mis)understanding that OpenSAML doesn't handle SAML2 signing yet. I'll look at that next.</p>
<div>Current problem is that when I sign an Envelope with header and/or body contents, the contents disappear during the signing step. I believe this is because EnvelopeMarshaller, HeaderMarshaller and BodyMarshaller are not expecting signatures or contents; for example EnvelopeMarshaller</div>
</div><blockquote style="margin: 0 0 0 40px; border: none; padding: 0px;"><div><p class="p1"></p><p class="p1"> <span class="s3">protected</span> <span class="s3">void</span> marshallElementContent(XMLObject xmlObject, Element domElement) <span class="s3">throws</span> MarshallingException { </p>
<p></p></div><div>// nothing to do, not element content</div><div><p class="p1"></p><p class="p2"> }</p><p></p></div></blockquote><div><p class="p1">I plan to explore whether extending the marshalElementContent methods might get me a bit further.</p>
<p class="p1"><br></p></div><div><p class="p1"><br></p></div><div><div><br><br><div class="gmail_quote">On Mon, Oct 31, 2011 at 3:53 PM, Brent Putman <span dir="ltr"><<a href="mailto:putmanb@georgetown.edu">putmanb@georgetown.edu</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;"><div class="im"><br>
<br>
On 10/30/11 7:42 AM, Brad Cox wrote:<br>
> Thanks, just what I need. Just one more question (I hope ;).<br>
><br>
> In<br>
> xmltooling/src/test/java/org/opensaml/xml/signature/EnvelopedSignatureTest.java<br>
> everything starts from SimpleXMLObject sxo =<br>
> getXMLObjectWithSignature(),<br>
<br>
<br>
</div>Well, the SimpleXMLObject is just a mock XMLObject provider that we use<br>
for testing some things. It's not relevant at all to actually writing<br>
real code. I don't even think it's available outside of the test classpath.<br>
<div class="im"><br>
<br>
> which<br>
> is the unsigned message envelope in my case. I have that parsed as a<br>
> Document,<br>
> but am stuck on how to marshal that, and to what. Test isn't very easy<br>
> to follow due<br>
> to deep nesting.<br>
<br>
<br>
</div>For info on the basics of building, marshalling and unmarshalling, you<br>
should first check out the OpenSAML User's Guide:<br>
<br>
<a href="https://wiki.shibboleth.net/confluence/display/OpenSAML/OSTwoUserManual" target="_blank">https://wiki.shibboleth.net/confluence/display/OpenSAML/OSTwoUserManual</a><br>
<br>
If that doesn't answer your questions, let us know.<br>
<div class="im"><br>
<br>
><br>
> I found a SAML1.1 EnvelopeBuilder but this needs to be SAML 2.0. Or is<br>
> XMLObjectBuilder<br>
> what I need in this case?<br>
<br>
</div>As Scott already pointed out, that is apples and oranges. I think you<br>
meant SOAP 1.1 Envelope* classes. A SAML (1.1 or 2.0) protocol message<br>
payload, or any other payload, would merely be set as the child of the<br>
Body of such an Envelope.<br>
<br>
In terms of the Signature stuff, you'd be using the XML Security support<br>
we have (package org.opensaml.ws.wssecurity). Sounds like you'd be<br>
adding a soap11:Envelope/soap11:Header/wsse:Security header and then<br>
likely adding a ds:Signature underneath there (as well as wsu:Timestamp<br>
and wsa:MessageID since you mentioned those). That's all fairly basic<br>
use of OpenSAML XML Object providers - just obtain a builder of the<br>
appropriate type, populate its data appropriately, and set the object as<br>
the child of the appropriate parent object.<br>
<br>
The complexity arises from the ds:SignedInfo/ds:Reference element(s)<br>
that you might need to add, but sounds like Scott is advocating a single<br>
ds:Reference with a URI="". That corresponds in our library to a<br>
org.opensaml.xml.signature.URIContentReference, with an empty string<br>
reference ID (construtor arg). You'll also have to supply the right<br>
digest method and transform(s) tot eh URIContentReference, based on<br>
whatever requirements the consumer (DOD?) specifies. Note that if you<br>
do whole-document signing as Scott advocates, you'll minimally need the<br>
enveloped signature transform. (Traditionally WS-S signatures are<br>
usually detached, and not enveloped, since they don't sign the whole<br>
document or Envelope, but instead specific headers and/or the Body. But<br>
in this case you'd be doing enveloped).<br>
<br>
That should get you started, let us know if you have further questions.<br>
<div><div></div><div class="h5"><br>
<br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:dev-unsubscribe@shibboleth.net">dev-unsubscribe@shibboleth.net</a><br>
</div></div></blockquote></div><br><br clear="all"><div><br></div>-- <br>Cell: 703-594-1883<br>Blog: <a href="http://bradjcox.blogspot.com">http://bradjcox.blogspot.com</a><br>Web: <a href="http://virtualschool.edu">http://virtualschool.edu</a><br>
Manassas VA 20111<br><br>
</div></div>