<div>I haven't had a chance to get back to trying your suggested fix, but I did open a ticket as requested.</div><div><br></div><font face="courier new,monospace"><a href="https://issues.shibboleth.net/jira/browse/MDA-58">https://issues.shibboleth.net/jira/browse/MDA-58</a><br clear="all">
</font>
<br><br><div class="gmail_quote">On Tue, Jan 24, 2012 at 6:10 AM, Chad La Joie <span dir="ltr"><<a href="mailto:lajoie@itumi.biz">lajoie@itumi.biz</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
You've correctly diagnosed the problem but not the solution. The<br>
EntityDescriptorItemIdPopulationStage is meant for something else[1].<br>
<br>
So, for now, you should do two things. First, file a bug. Second,<br>
create a stage that generates and sets an ID on an EntityDescriptor or<br>
EntitiesDescriptor (which is what I'll do when I fix the issue).<br>
<br>
[1] This stage is meant to take the identifier of an EntityDescriptor<br>
and add it to the metadata of the given item. That is, it takes a<br>
SAML specific thing and copies it to a protocol agnostic location so<br>
that other plugins can work on it. Once the MDA web service is<br>
available, this is also how it will look up information by ID.<br>
<div class="HOEnZb"><div class="h5"><br>
On Mon, Jan 23, 2012 at 23:25, Dan McLaughlin<br>
<<a href="mailto:dmclaughlin@tech-consortium.com">dmclaughlin@tech-consortium.com</a>> wrote:<br>
> The new version of the MDA seemed to work fine, then today I actually<br>
> tried to get our SP to consume the metadata it aggregated and signed,<br>
> but every time I enabled the Signature MetadataFilter to validate the<br>
> signature I would get an error telling me "CRIT Shibboleth.Application<br>
> : error initializing MetadataProvider: SignatureMetadataFilter unable<br>
> to verify signature at root of metadata instance."<br>
><br>
> I assumed maybe my private/public key pair I was using to sign and<br>
> validate the metadata was bad, so I used openssl to verify that the<br>
> private key I used with the MDA to sign the metadata matched the<br>
> public key I was using in the SP to validate the signature. Long<br>
> story short, openssl confirmed they matched.<br>
><br>
> Then I used xmlsectool to validate the signature on the metadata<br>
> generated by MDA and it complained as well, but gave me a little more<br>
> detail.<br>
><br>
> xmlsectool.sh --verifySignature --certificate<br>
> ./certs/my-signing-cert.pem --inFile<br>
> /tmp/mda/federation/my-federation-metadata.xml<br>
> INFO XmlSecTool - Reading XML document from file<br>
> '/tmp/mda/federation/my-federation-metadata.xml'<br>
> INFO XmlSecTool - XML document parsed and is well-formed.<br>
> ERROR XmlSecTool - Unknown error<br>
> java.lang.StringIndexOutOfBoundsException: String index out of range: -1<br>
> at java.lang.String.substring(String.java:1937) ~[na:1.6.0_29]<br>
> at java.lang.String.substring(String.java:1904) ~[na:1.6.0_29]<br>
> at edu.internet2.middleware.security.XmlSecTool.validateSignatureReferenceUri(XmlSecTool.java:623)<br>
> ~[xmlsectool-1.1.5.jar:na]<br>
> at edu.internet2.middleware.security.XmlSecTool.validateSignatureReference(XmlSecTool.java:602)<br>
> ~[xmlsectool-1.1.5.jar:na]<br>
> at edu.internet2.middleware.security.XmlSecTool.verifySignature(XmlSecTool.java:554)<br>
> ~[xmlsectool-1.1.5.jar:na]<br>
> at edu.internet2.middleware.security.XmlSecTool.main(XmlSecTool.java:156)<br>
> ~[xmlsectool-1.1.5.jar:na]<br>
><br>
> Which led me to<br>
> <a href="https://issues.shibboleth.net/jira/browse/XSTJ-15?page=com.atlassian.jira.plugin.system.issuetabpanels%3Acomment-tabpanel#issue-tabs" target="_blank">https://issues.shibboleth.net/jira/browse/XSTJ-15?page=com.atlassian.jira.plugin.system.issuetabpanels%3Acomment-tabpanel#issue-tabs</a><br>
><br>
> Then I decided to add an XMLSignatureValidationStage to my MDA<br>
> configuration to validate the signature after the MDA signed it, and I<br>
> got the following error:<br>
><br>
> mda.sh /tmp/mda/my-federation-config.xml validateSignature<br>
> <a href="tel:2012-01-23%2019" value="+12012012319">2012-01-23 19</a>:39:46,391 - WARN<br>
> [org.apache.xml.security.signature.Reference:-1] - Verification failed<br>
> for URI ""<br>
> <a href="tel:2012-01-23%2019" value="+12012012319">2012-01-23 19</a>:39:46,394 - WARN<br>
> [org.apache.xml.security.signature.Reference:-1] - Expected Digest:<br>
> I0I+qxu89yE2c6grAFkgO+IbgaEv9DIhCYiGe+JDA/Q=<br>
> <a href="tel:2012-01-23%2019" value="+12012012319">2012-01-23 19</a>:39:46,395 - WARN<br>
> [org.apache.xml.security.signature.Reference:-1] - Actual Digest:<br>
> usLmjOJIFNbagPGDEVXW0C0fhwLEtZ8jt0FWWx0/VIA=<br>
><br>
> As I test I manually added an ID (ID=MYM20120123T194212) to the<br>
> EntitiesDescriptor that the MDA created using the<br>
> EntitiesDescriptorAssemblerStage, then I used xmlsectool to sign the<br>
> metadata using --referenceIdAttributeName ID. Now I had no issues<br>
> validating the signature.<br>
><br>
> ./xmlsectool.sh --sign --referenceIdAttributeName ID --inFile<br>
> /tmp/mda/federation/my-federation-metadata-unsigned.xml --key<br>
> ../certs/my-signing-key.pem --certificate ../certs/my-signing-cert.pem<br>
> --outFile /tmp/mda/federation/my-federation-metadata.xml<br>
> INFO XmlSecTool - Reading XML document from file<br>
> '/tmp/mda/federation/my-federation-metadata-unsigned.xml'<br>
> INFO XmlSecTool - XML document parsed and is well-formed.<br>
> INFO XmlSecTool - XML document successfully signed<br>
> INFO XmlSecTool - XML document written to file<br>
> /tmp/mda/federation/my-federation-metadata.xml<br>
><br>
> ./xmlsectool.sh --verifySignature --signatureRequired --certificate<br>
> ../certs/my-signing-cert.pem --inFile<br>
> /tmp/mda/federation/my-federation-metadata.xml<br>
> INFO XmlSecTool - Reading XML document from file<br>
> '/tmp/mda/federation/my-federation-metadata.xml'<br>
> INFO XmlSecTool - XML document parsed and is well-formed.<br>
> INFO XmlSecTool - XML document signature verified.<br>
><br>
> I think I'm on the right track...<br>
><br>
> The signature that the MDA is adding isn't valid because the Reference<br>
> URI for the Signature isn't getting set by my<br>
> XMLSignatureSigningStage, the reason the Reference URI isn't getting<br>
> set is because the EntitiesDescriptorAssemblerStage doesn't set the ID<br>
> for the EntitiesDescriptor, the reason the ID isn't getting set for<br>
> the EntitiesDescriptor is because I don't have a<br>
> EntityDescriptorItemIdPopulationStage, and the reason I don't have an<br>
> EntityDescriptorItemIdPopulationStage is because I used the examples<br>
> to build my MDA configuration (which also don't use an<br>
> EntityDescriptorItemIdPopulationStage), so I never realized until<br>
> after several hours of debugging today that it was even necessary.<br>
><br>
> Now for the difficult question...Does anyone have an example that<br>
> shows how to properly define an EntityDescriptorItemIdPopulationStage<br>
> so I can get an ID assigned to my EntitiesDescriptor?<br>
</div></div><div class="HOEnZb"><div class="h5">> --<br>
> To unsubscribe from this list send an email to <a href="mailto:dev-unsubscribe@shibboleth.net">dev-unsubscribe@shibboleth.net</a><br>
<br>
<br>
<br>
--<br>
Chad La Joie<br>
<a href="http://www.itumi.biz" target="_blank">www.itumi.biz</a><br>
trusted identities, delivered<br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:dev-unsubscribe@shibboleth.net">dev-unsubscribe@shibboleth.net</a><br>
</div></div></blockquote></div><br>