1. I am not signing and validating the same instance. I write the whole metadata to a file, then in step 2, I load it and validate it. So I don't think I am hinting the same issue.<br><br>2. Even if I just load a testing metadata file, for example openid-metadata.xml, which you are using in the unit test as well. I still see the same error. So maybe my code to validate the signature is wrong?<br clear="all">
Here is my code, which is pretty much same as wiki:<br> public void validateSignature(Signature signature, Credential validatingCredential) throws ValidationException<br> {<br> SAMLSignatureProfileValidator profileValidator = new SAMLSignatureProfileValidator();<br>
profileValidator.validate( signature );<br> <br> SignatureValidator signatureValidator = new SignatureValidator( validatingCredential );<br> // Now try to validate. Throw exception if not valid.<br>
signatureValidator.validate( signature );<br> }<br> For testing, validatingCredential is the one I get under the <Signature><KeyInfo> tag. Can you see any problems? Or do you have any simple working example that I can look at?<br>
<br>3. Regarding this sentence: " The
KeyDescriptor/KeyInfo is the entity's own key that it uses for SAML
purposes, and in the real world is very often not the metadata
signing key." We are currently in the process of developing a Single Sign On product, can you please tell me more about why these two keys are very often no the same?<br><br>4. Thanks for you information about TrustEngine. I will look into it and if possible implement it in our product.<br>
<br><div class="gmail_quote">On Wed, Oct 31, 2012 at 5:54 PM, Brent Putman <span dir="ltr"><<a href="mailto:putmanb@georgetown.edu" target="_blank">putmanb@georgetown.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div class="im"><br>
On 10/31/12 8:40 PM, Yaowen Tu wrote:<br>
> Another related question is: how to retrieve the credential under<br>
> <Signature>?<br>
<br>
</div>You use a KeyInfoCredentialResolver to resolve Credentials from a<br>
ds:KeyInfo element. I don't know if that's documented in the wiki, but<br>
I'm sure there are some unit tests you can use as an example.<br>
<br>
In general, though, be careful that the Signature/KeyInfo is only a<br>
hint, you can not trust that key. You have to validate that the key is<br>
trusted, one way or another (either from a set of trusted keys or via<br>
X.509 PKIX, etc).<br>
<br>
We also have a higher-level of abstraction called TrustEngine, which<br>
wraps up the signature verification and trust processing in a single<br>
component.<br>
<div class="HOEnZb"><div class="h5"><br>
<br>
<br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:dev-unsubscribe@shibboleth.net">dev-unsubscribe@shibboleth.net</a><br>
</div></div></blockquote></div><br>