<span style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:13px;background-color:rgb(255,255,255)">Hi All, </span><div style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:13px;background-color:rgb(255,255,255)">
<br></div><div style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:13px;background-color:rgb(255,255,255)">I am reposting this message, since it looks like that I sent to the opensaml user mailing list, after a slight misunderstanding, </div>
<div style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:13px;background-color:rgb(255,255,255)">because of my english! :-)</div><div style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:13px;background-color:rgb(255,255,255)">
<div><br></div><div><div>Using OpenSAML I correctly validate the signature of an assertion that has as Subject Confirmation Data the following </div><div><br></div><p style="margin:0px;font-size:12px;font-family:Helvetica;color:rgb(171,69,0)">
<span style="color:rgb(0,0,0)"> </span><span style="color:rgb(2,29,167)"><wsse:SecurityTokenReference</span><span style="color:rgb(249,151,94)"> </span><span style="color:rgb(0,0,0)"><br></span><span style="color:rgb(249,151,94)"> </span><span style="color:rgb(0,170,214)">xmlns:wsse</span><span style="color:rgb(255,148,80)">=</span>"<a href="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" target="_blank" style="color:rgb(17,85,204)">http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd</a>"<span style="color:rgb(2,29,167)">></span><span style="color:rgb(0,0,0)"><br>
</span><span style="color:rgb(2,29,167)"><wsse:KeyIdentifier</span><span style="color:rgb(249,151,94)"> </span><span style="color:rgb(0,0,0)"><br></span><span style="color:rgb(249,151,94)"> ValueType</span><span style="color:rgb(255,148,80)">=</span>"<a href="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentifier" target="_blank" style="color:rgb(17,85,204)">http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentifier</a>"<span style="color:rgb(2,29,167)">></span><span style="color:rgb(0,0,0)"><br>
Ytig1daWMVvZKbESb1W10TpDcJY=<br> </span><span style="color:rgb(2,29,167)"></wsse:KeyIdentifier></span><span style="color:rgb(0,0,0)"><br></span></p><div><span style="font-family:Helvetica;font-size:12px"> </span><span style="font-family:Helvetica;font-size:12px;color:rgb(2,29,167)"></wsse:SecurityTokenReference></span></div>
<div><br></div><div> <br clear="all"><div>When I add this assertion to a newly created security header, DOM is pushing the namespace in the security header element, as:</div><div><br></div><div><p style="color:rgb(171,69,0);font-size:12px;font-family:Helvetica;margin:0px">
<span style="color:rgb(2,29,167)"><wsse:Security</span><span style="color:rgb(249,151,94)"> </span><span style="color:rgb(0,170,214)">xmlns:wsse</span><span style="color:rgb(255,148,80)">=</span>"<a href="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" target="_blank" style="color:rgb(17,85,204)">http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd</a>"<span style="color:rgb(2,29,167)">></span><span style="color:rgb(0,0,0)"><br>
</span><span style="color:rgb(2,29,167)"><saml2:Assertion</span></p><p style="color:rgb(171,69,0);font-size:12px;font-family:Helvetica;margin:0px"><span style="color:rgb(2,29,167)"><br></span></p><p style="color:rgb(171,69,0);font-size:12px;font-family:Helvetica;margin:0px">
<span style="color:rgb(0,0,0);font-family:arial;font-size:small">causing the keyInfo of the Subject Confirmation Data to be: </span></p><p style="color:rgb(171,69,0);font-size:12px;font-family:Helvetica;margin:0px"><span style="color:rgb(0,0,0);font-family:arial;font-size:small"><br>
</span></p><p style="margin:0px"></p><p style="color:rgb(171,69,0);font-size:12px;margin:0px;font-family:Helvetica"><span style="color:rgb(2,29,167)"><wsse:SecurityTokenReference><wsse:KeyIdentifier</span><span style="color:rgb(249,151,94)"> ValueType</span><span style="color:rgb(255,148,80)">=</span>"<a href="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentifier" target="_blank" style="color:rgb(17,85,204)">http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentifier</a>"<span style="color:rgb(2,29,167)">></span><span style="color:rgb(0,0,0)">Ytig1daWMVvZKbESb1W10TpDcJY=</span><span style="color:rgb(2,29,167)"></wsse:KeyIdentifier></wsse:SecurityTokenReference></span></p>
<p style="color:rgb(171,69,0);font-size:12px;margin:0px;font-family:Helvetica"><span style="color:rgb(2,29,167)"><br></span></p><p style="color:rgb(171,69,0);font-size:12px;margin:0px;font-family:Helvetica"><span style="color:rgb(0,0,0);font-family:arial;font-size:small">and this seems to break the validation of the saml assertion:</span></p>
<p style="color:rgb(171,69,0);font-size:12px;margin:0px;font-family:Helvetica"><span style="color:rgb(0,0,0);font-family:arial;font-size:small"><br></span></p><p style="color:rgb(171,69,0);font-size:12px;margin:0px;font-family:Helvetica">
Caused by: org.opensaml.xml.validation.ValidationException: Signature did not validate against the credential's key</p><p style="color:rgb(171,69,0);font-size:12px;margin:0px;font-family:Helvetica"><span style="white-space:pre-wrap"> </span>at org.opensaml.xml.signature.SignatureValidator.validate(SignatureValidator.java:78)</p>
<p style="color:rgb(171,69,0);font-size:12px;margin:0px;font-family:Helvetica"><span style="color:rgb(0,0,0);font-family:arial;font-size:small"><br></span></p><p style="margin:0px">How to avoid this situation? The assertion's SignedInfo is: </p>
<p style="margin:0px"><br></p><p style="margin:0px"></p><p style="margin:0px"> <ds:SignedInfo></p><p style="margin:0px"> <ds:CanonicalizationMethod Algorithm="<a href="http://www.w3.org/2001/10/xml-exc-c14n#" target="_blank" style="color:rgb(17,85,204)">http://www.w3.org/2001/10/xml-exc-c14n#</a>"/></p>
<p style="margin:0px"> <ds:SignatureMethod Algorithm="<a href="http://www.w3.org/2000/09/xmldsig#rsa-sha1" target="_blank" style="color:rgb(17,85,204)">http://www.w3.org/2000/09/xmldsig#rsa-sha1</a>"/></p>
<p style="margin:0px"> <ds:Reference URI="#uuid-d8840a0d-fa90-4522-806e-edc8dc427d2b"></p><p style="margin:0px"> <ds:Transforms></p><p style="margin:0px"> <ds:Transform Algorithm="<a href="http://www.w3.org/2000/09/xmldsig#enveloped-signature" target="_blank" style="color:rgb(17,85,204)">http://www.w3.org/2000/09/xmldsig#enveloped-signature</a>"/></p>
<p style="margin:0px"> <ds:Transform Algorithm="<a href="http://www.w3.org/2001/10/xml-exc-c14n#" target="_blank" style="color:rgb(17,85,204)">http://www.w3.org/2001/10/xml-exc-c14n#</a>"/></p>
<p style="margin:0px"> </ds:Transforms></p><p style="margin:0px"> <ds:DigestMethod Algorithm="<a href="http://www.w3.org/2000/09/xmldsig#sha1" target="_blank" style="color:rgb(17,85,204)">http://www.w3.org/2000/09/xmldsig#sha1</a>"/></p>
<p style="margin:0px"> <ds:DigestValue>ghAD3gMLcZvyXFhVXJwNkeHCGi8=</ds:DigestValue></p><p style="margin:0px"> </ds:Reference></p><p style="margin:0px"> </ds:SignedInfo></p>
<p style="margin:0px"><br></p><p style="margin:0px">AFAIK, the two xmls are semantically equivalent, thus the signature shall behave the same, or am I wrong?</p></div></div></div></div><div><br></div>-- <br>Massimiliano Masi<br>
<br><a href="http://www.mascanc.net/~max">http://www.mascanc.net/~max</a><br>