Making progress; getting plausible signed envelopes and shooting now for validation, but need a bit more help decoding the instructions at the very bottom. <div><br></div><div>The first sentence is what sent me on the prior wild goose chase. As I read this, "SAMLObject" means an instance of Envelope (right?). Problem is at this point exists only as as Element, and I've so far been unable to marshal that to an Envelope. And in any event Envelope doesn't have a setSignature() method.</div>
<div><br></div><div>So what I have now works entirely at the DOM level which doesn't seem right. </div><div><br></div><div><div><span class="Apple-tab-span" style="white-space:pre"> </span>public void attachSamlAssertion(Document document)</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>{</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>Element soapEnvelope = document.getDocumentElement();</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>Element soapHeader = DOMUtil.getSoapHeader(soapEnvelope);</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>Element soapBody = DOMUtil.getSoapBody(soapEnvelope);</div><div><br></div><div><span class="Apple-tab-span" style="white-space:pre"> </span>try</div><div>
<span class="Apple-tab-span" style="white-space:pre"> </span>{</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>SecurityMarshaller m3 = new SecurityMarshaller();</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>Element securityElmt = m3.marshall(newSecurity(), document);</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>soapHeader.appendChild(securityElmt);</div><div><br></div><div><span class="Apple-tab-span" style="white-space:pre"> </span>Signature signature = newSignature();</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>SignatureMarshaller sigM = new SignatureMarshaller();</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>Element signatureElmt = sigM.marshall(signature, document);</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>securityElmt.appendChild(signatureElmt);</div><div><br></div><div><span class="Apple-tab-span" style="white-space:pre"> </span>TimestampMarshaller tsm = new TimestampMarshaller();</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>Element timeStampElmt = tsm.marshall(newTimeStamp(), document);</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>securityElmt.appendChild(timeStampElmt);</div>
<div><br></div><div><span class="Apple-tab-span" style="white-space:pre"> </span>MessageIDMarshaller mim= new MessageIDMarshaller();</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>Element msgIDElmt = mim.marshall(newMessageID(), document);</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>securityElmt.appendChild(msgIDElmt);</div><div><br></div><div><span class="Apple-tab-span" style="white-space:pre"> </span>Assertion assertion = newAssertion();</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>AssertionMarshaller marshaller = new AssertionMarshaller();</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>Element assertionElmt = marshaller.marshall(assertion, document);</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>securityElmt.appendChild(assertionElmt);</div><div><br></div><div><span class="Apple-tab-span" style="white-space:pre"> </span><a href="http://log.info">log.info</a>("Unsigned Document\n{}", XMLHelper.prettyPrintXML(soapEnvelope));</div>
<div><br></div><div><span class="Apple-tab-span" style="white-space:pre"> </span>Signer.signObject(signature);</div><div><span class="Apple-tab-span" style="white-space: pre; "> </span><a href="http://log.info">log.info</a>("Signed Envelope\n{}", XMLHelper.prettyPrintXML(soapEnvelope));</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span></div><div><span class="Apple-tab-span" style="white-space:pre"> </span>// Worrisome but without it getDocumentElement == null</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>document.adoptNode(soapEnvelope);</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>document.appendChild(soapEnvelope);</div><div><span class="Apple-tab-span" style="white-space: pre; "> </span>return;</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>}</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>catch (Exception e)</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>{</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>throw new XacmlFault(e);</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>}</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>}</div></div><div><br></div><div>Next I've been unable to decode Step#5 to generate a KeyInfo which I think I'll need for validation (right?). </div>
<div><br></div><div>Fails with a null pointer on the line marked NPE -> below </div><div><br></div><div><div><span class="Apple-tab-span" style="white-space:pre"> </span>public Signature newSignature()</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>{</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>SignatureBuilder bldr = (SignatureBuilder) factory.getBuilder(Signature.DEFAULT_ELEMENT_NAME);</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>Signature sig = (Signature) bldr.buildObject();</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>Credential credential = signer.getCredential();</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>sig.setSigningCredential(credential);</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>sig.setCanonicalizationAlgorithm(SignatureConstants.ALGO_ID_C14N_EXCL_OMIT_COMMENTS);</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>sig.setSignatureAlgorithm(SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA1);</div>
<div><br></div><div><span class="Apple-tab-span" style="white-space:pre"> </span>KeyInfoGeneratorManager kgm = new KeyInfoGeneratorManager();</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>KeyInfoGeneratorFactory kif = kgm.getFactory(credential);</div>
<div>NPE-><span class="Apple-tab-span" style="white-space:pre"> </span>KeyInfoGenerator kig = kif.newInstance();</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>try</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>{</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>KeyInfo ki = kig.generate(credential);</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>sig.setKeyInfo(ki);</div><div>//<span class="Apple-tab-span" style="white-space:pre"> </span>KeyInfoFactory kFactory = factory.getKeyInfoFactory();</div>
<div>//<span class="Apple-tab-span" style="white-space:pre"> </span>keyInfo = kFactory.newKeyInfo(Collections.singletonList (kFactory.newX509Data</div><div>//<span class="Apple-tab-span" style="white-space:pre"> </span>(Collections.singletonList (entry.getCertificate ()))));</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>}</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>catch (SecurityException ex)</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>{</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>throw new XacmlFault("KeyInfo fault", ex);</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>}</div><div><br></div><div>
<span class="Apple-tab-span" style="white-space: pre; "> </span>URIContentReference contentReference = new URIContentReference("");</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>contentReference.getTransforms().add(SignatureConstants.TRANSFORM_ENVELOPED_SIGNATURE);</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>contentReference.getTransforms().add(SignatureConstants.TRANSFORM_C14N_EXCL_OMIT_COMMENTS);</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>contentReference.setDigestAlgorithm(SignatureConstants.ALGO_ID_DIGEST_SHA1);</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>sig.getContentReferences().add(contentReference);</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>return sig;</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>}</div></div><div><br></div><div>Here are the instructions I've been trying to follow. (Wouldn't a code sample be easier?)</div>
<blockquote style="margin: 0 0 0 40px; border: none; padding: 0px;"><div><p style="font-size: 13px; line-height: 17px; color: rgb(51, 51, 51); background-image: none; background-attachment: initial; background-origin: initial; background-clip: initial; background-color: rgb(255, 255, 255); margin-top: 10px; margin-right: 0px; margin-bottom: 10px; margin-left: 0px; padding-top: 0px; padding-right: 0px; padding-bottom: 0px; padding-left: 0px; font-family: Helvetica, Arial, sans-serif; text-align: left; ">
The first step in signing a SAMLObject is to create a Signature object and attach it to the SAMLObject. Since all SAMLObjects that can be signed implement the interface <tt>org.opensaml.common.SignableSAMLObject</tt> the code to sign an object is always the same.</p>
</div></blockquote><div><ol style="font-size: 13px; line-height: 17px; color: rgb(51, 51, 51); font-family: Helvetica, Arial, sans-serif; text-align: left; background-color: rgb(255, 255, 255); "><ol><li style="font-size: 10pt; line-height: 13pt; margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; padding-top: 0px; padding-right: 0px; padding-bottom: 0px; padding-left: 0px; ">
Create a <tt>Signature</tt> object using the <tt>org.opensaml.xml.signature.impl.SignatureBuilder</tt> (this is found in the XMLTooling library). This will likely be obtained from a builder factory. See <a href="https://wiki.shibboleth.net/confluence/display/OpenSAML/OSTwoUsrManJavaCreateFromScratch" title="OSTwoUsrManJavaCreateFromScratch" style="color: rgb(50, 96, 186); text-decoration: none; ">Creating SAML Objects from Scratch</a>.</li>
<li style="font-size: 10pt; line-height: 13pt; margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; padding-top: 0px; padding-right: 0px; padding-bottom: 0px; padding-left: 0px; ">Add the <tt>Credential</tt> containing the signing key using the <tt>Signature#setSigningCredential(Credential)</tt> method.</li>
<li style="font-size: 10pt; line-height: 13pt; margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; padding-top: 0px; padding-right: 0px; padding-bottom: 0px; padding-left: 0px; ">Add the signature method algorithm URI with the method <tt>Signature#setSignatureAlgorithm(String)</tt>. Note that the algorithm URI is dependent on the type of key contained with the signing credential.</li>
<li style="font-size: 10pt; line-height: 13pt; margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; padding-top: 0px; padding-right: 0px; padding-bottom: 0px; padding-left: 0px; ">Add the canonicalization method algorithm URI with the method <tt>Signature#setCanonicalizationAlgorithm(String)</tt>. Note that unless there is good reason to do otherwise, and the ramifications are understood, the recommended canonicalization method for SAML signature use cases is exclusive canonicalization (with or without comments).</li>
<li style="font-size: 10pt; line-height: 13pt; margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; padding-top: 0px; padding-right: 0px; padding-bottom: 0px; padding-left: 0px; ">If desired, add a <tt>KeyInfo</tt> containing information about the signature verification key using <tt>Signature#setKeyInfo(KeyInfo)</tt>. The<tt>KeyInfo</tt> may be created manually, or may be generated dynamically from the signing credential using a <tt>KeyInfoGenerator</tt>, usually obtained from a <tt>KeyInfoGeneratorFactory</tt> via a <tt>KeyInfoGeneratorManager</tt>.</li>
<li style="font-size: 10pt; line-height: 13pt; margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; padding-top: 0px; padding-right: 0px; padding-bottom: 0px; padding-left: 0px; ">Add the <tt>Signature</tt> to the SAMLObject using the <tt>setSignature(Signature)</tt> method. A <tt>SAMLObjectContentReference</tt> will automatically be added to the list of signature references exposed via <tt>Signature#getContentReferences()</tt>, so you should <b>NOT</b> explicitly add a reference to the signature. Note that the <tt>Signature</tt> contained within a signed element in SAML may contain only one <tt>Reference</tt> in the<tt>SignedInfo</tt>, per the SAML signature profile.</li>
</ol></ol></div>