Another related question is: how to retrieve the credential under <Signature>?<br><br>I am using the following code:<br><br> CriteriaSet entityCriteriaSet = new CriteriaSet();<br> entityCriteriaSet.add( new MetadataCriteria( SPSSODescriptor.DEFAULT_ELEMENT_NAME, SAMLConstants.SAML20P_NS ) );<br>
entityCriteriaSet.add( new EntityIDCriteria( entityID ) );<br> <br> Credential entitySignatureCredential = (X509Credential) credentialResolver.resolveSingle( entityCriteriaSet );<br>
<br>It seems like it will return the credential under <KeyDescriptor> not the one under <Signature><br><br>Thanks,<br clear="all">Yaowen<br>
<br><br><div class="gmail_quote">On Wed, Oct 31, 2012 at 4:53 PM, Yaowen Tu <span dir="ltr"><<a href="mailto:yaowen.tu@gmail.com" target="_blank">yaowen.tu@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
What I am passing into the valida() is a Signature, and there is only one signature under SPSSODescriptor, so that cannot be wrong, is it?<br><br>Another question, can you take a look at the metadata that I just sent again? The structure is like:<br>
<br><md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" entityID="<a href="http://www.localhost.com" target="_blank">www.localhost.com</a>"><br> <md:SPSSODescriptor AuthnRequestsSigned="false" WantAssertionsSigned="false" errorURL="<a href="http://www.localhost.com/SAML/ERROR" target="_blank">www.localhost.com/SAML/ERROR</a>" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol"><br>
<ds:Signature xmlns:ds="<a href="http://www.w3.org/2000/09/xmldsig#" target="_blank">http://www.w3.org/2000/09/xmldsig#</a>"><br> ........<br> <span style="color:rgb(0,102,0)"><ds:KeyInfo></span><br>
<ds:X509Data><br> <ds:X509Certificate>.......</ds:X509Certificate><br> </ds:X509Data><br> </ds:KeyInfo><br> </ds:Signature><br>
<md:KeyDescriptor><br> <span style="color:rgb(0,102,0)"><ds:KeyInfo</span> xmlns:ds="<a href="http://www.w3.org/2000/09/xmldsig#" target="_blank">http://www.w3.org/2000/09/xmldsig#</a>"><br>
<ds:X509Data><br>
<ds:X509Certificate>........</ds:X509Certificate><br> </ds:X509Data><br> </ds:KeyInfo><br> </md:KeyDescriptor><br> </md:SPSSODescriptor><br>
</md:EntityDescriptor><br><br>There are two <KeyInfo>, I am using the same public key and private key to generate it, so does is matter to use which one to verify the signature? I think no, but I just want to rule out this case.<span class="HOEnZb"><font color="#888888"><br>
<br clear="all">Yaowen<br>
<br><br></font></span><div class="gmail_quote"><div><div class="h5">On Wed, Oct 31, 2012 at 4:30 PM, Brent Putman <span dir="ltr"><<a href="mailto:putmanb@georgetown.edu" target="_blank">putmanb@georgetown.edu</a>></span> wrote:<br>
</div></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div><div class="h5">
<div bgcolor="#FFFFFF" text="#000000"><div>
<br>
<div>On 10/31/12 7:23 PM, Yaowen Tu wrote:<br>
</div>
<blockquote type="cite">1. I am not sure how to check if I am passing
EntityDescriptor or SPSSODescriptor. In the code sample of the
wiki:<br>
<br clear="all">
<div><font size="4"><code> Credential verificationCredential
= getVerificationCredential(response);</code></font></div>
<div><font size="4"><code> SignatureValidator sigValidator =
</code><code>new</code> <code>SignatureValidator(verificationCredential);<br>
<font size="4"> <font size="4"> The SignatureValidator only
<font size="4">need a credential. I think as long as I
get the <font size="4">credential</font> under </font></font></font></code></font><font size="4"><code><font size="4"><font size="4"><font size="4">SPSSODescriptor, that should be
fine.<font size="4"><font size="4"><font size="4"> </font></font>Is
that correct? <br>
</font></font></font></font></code></font></div>
</blockquote>
<br>
<br></div>
I meant what you are passing to the validate(...) method. Although
I forgot that your error is actually on the
SAMLSignatureProfileValidator, so it's whatever you are passing to
the validate(...) method of that.<br>
<br>
You error is odd though, b/c you have a non-null Signature which is
saying it doesn't contain the Apache XMLSignature object. So
something that you are doing is off.<br>
<br>
<br>
</div>
<br></div></div><div class="im">--<br>
To unsubscribe from this list send an email to <a href="mailto:dev-unsubscribe@shibboleth.net" target="_blank">dev-unsubscribe@shibboleth.net</a><br></div></blockquote></div><br>
</blockquote></div><br>