Great news. It works; generates headers and validates same. Truly grateful for all the help!! Two questions remain tho (surprise! ;). <div><br></div><div><b>The doubled marshalling calls, before/after signing, are essential acc'd the debugger, but are troubling. Is this just an accident of OpenSAML history, or truly essential to the nature of the problem? I can live with it either way; just askin'<br>
</b><br>
<div><div><span class="Apple-tab-span" style="white-space:pre"> </span>public void attachSamlAssertion(Document document)</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>{</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>Element envelopeElmt = document.getDocumentElement();</div>
<div>//<span class="Apple-tab-span" style="white-space:pre"> </span>log.debug("Unsigned Document\n{}", XMLHelper.prettyPrintXML(envelopeElmt));</div><div><br></div><div><span class="Apple-tab-span" style="white-space:pre"> </span>try</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>{</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>Unmarshaller unmarshaller = unmarshallerFactory.getUnmarshaller(envelopeElmt);</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>XMLObject envelopeObj = unmarshaller.unmarshall(envelopeElmt);</div><div><br></div><div><span class="Apple-tab-span" style="white-space:pre"> </span>Envelope envelope = (Envelope) envelopeObj;</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>Header header = envelope.getHeader();</div><div><br></div><div><span class="Apple-tab-span" style="white-space:pre"> </span>Security security = newSecurity();</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>header.getUnknownXMLObjects().add(security);</div><div><br></div><div><span class="Apple-tab-span" style="white-space:pre"> </span>Signature signature = newSignature();</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>security.getUnknownXMLObjects().add(signature);</div><div><br></div><div><span class="Apple-tab-span" style="white-space:pre"> </span>Timestamp timestamp = newTimeStamp();</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>security.getUnknownXMLObjects().add(timestamp);</div><div><br></div><div><span class="Apple-tab-span" style="white-space:pre"> </span>MessageID messageID = newMessageID();</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>security.getUnknownXMLObjects().add(messageID);</div><div><br></div><div><span class="Apple-tab-span" style="white-space:pre"> </span>Assertion assertion = newAssertion();</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>security.getUnknownXMLObjects().add(assertion);</div><div><br></div><div><span class="Apple-tab-span" style="white-space:pre"> </span>// Looks bogus but is required to establish XMLSignature within signature.</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>Marshaller marshaller1 = marshallerFactory.getMarshaller(envelope);</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>Element unsignedEnvelope = marshaller1.marshall(envelope, document);</div>
<div>//<span class="Apple-tab-span" style="white-space:pre"> </span>log.debug("Unsigned Document\n{}", XMLHelper.prettyPrintXML(unsignedEnvelope));</div><div><br></div><div><span class="Apple-tab-span" style="white-space:pre"> </span>Signer.signObject(signature);</div>
<div><br></div><div><span class="Apple-tab-span" style="white-space:pre"> </span>// Required to convert to Element to set into document with</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>// SignatureValue and DigestValue properly set.</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>Marshaller marshaller = marshallerFactory.getMarshaller(envelope);</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>Element signedEnvelope = marshaller.marshall(envelope, document);</div>
<div>//<span class="Apple-tab-span" style="white-space:pre"> </span>log.debug("Signed Document\n{}", XMLHelper.prettyPrintXML(signedEnvelope));</div><div><br></div><div><span class="Apple-tab-span" style="white-space:pre"> </span>document.adoptNode(signedEnvelope);</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>document.appendChild(signedEnvelope);</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>return;</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>}</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>catch (Exception e)</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>{</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>throw new XacmlFault(e);</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>}</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>}</div></div></div><div><br></div><div><b>The second is in the signature validation code shown below. The comment is from the instructions. However when the SAMLSignatureProfileValidator call is enabled, it fails with "Signature is not an immedidate child of a SignableSAMLObject. Right, knew that, its a child of Security which isn't a SignableSAMLObject. But is there a way to salvage the protections of this function for my use case? </b></div>
<div><br></div><div><div><span class="Apple-tab-span" style="white-space:pre"> </span>private void okSignature(Signature signature) throws ValidationException</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>{</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>// In order to prevent certain types of denial-of-service attacks</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>// associated with signature verification, it is advisable to successfully</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>// validate the Signature with the</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>// org.opensaml.security.SAMLSignatureProfileValidator</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>// prior to attempting to cryptographically verify the signature.</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>//</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>// bcox: disabled becauase fails with "Signature is not an immedidate</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>// child of a SignableSAMLObject" when Signature is attached to</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>// Security element (which is not a SignableSAMLObject).</div>
<div>//<span class="Apple-tab-span" style="white-space:pre"> </span>SAMLSignatureProfileValidator svpf = new SAMLSignatureProfileValidator();</div><div>//<span class="Apple-tab-span" style="white-space:pre"> </span>svpf.validate(signature);</div>
<div><br></div><div><span class="Apple-tab-span" style="white-space:pre"> </span>SignatureValidator validator = new SignatureValidator(getCredential());</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>validator.validate(signature);</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>}</div></div>