<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<br>
<div class="moz-cite-prefix">On 10/31/12 7:53 PM, Yaowen Tu wrote:<br>
</div>
<blockquote
cite="mid:CAE7YPDKq0E_bBRZkDkbp_3jUC=v7hs7k-KnU+VXVCN=BF7K0ww@mail.gmail.com"
type="cite">What I am passing into the valida() is a Signature,
and there is only one signature under SPSSODescriptor, so that
cannot be wrong, is it?<br>
</blockquote>
<br>
As long as you are consistently signing and validating the same
signature object, that is correct.<br>
<br>
Another thought is: If you're writing a unit test, etc, it's best
if you at least marshall the XML to DOM and then unmarshall a new
XMLObject tree around it, and then validate the signature on the new
tree. Of course you can also fully serialize it out and the
deserialize and unmarshall. It used to be the case that Santuario
(low level Apache XML Signature library) wouldn't even work if you
signed and then immediately validated the same XMLSignature
instance. I don't know if that's still a problem, and you aren't
even getting that far yet, but it's possible that whatever you are
doing is triggering a similar issue at the OpenSAML layer. In
general signing and then immediately validating the same Signature
instance isn't a real world use case - only for artificial cases
like tests and such - and so I don't know for a fact that that would
even work in OpenSAML. That's the only other thing I can think of
off-hand which might cause the (weird) issue you are seeing.<br>
<br>
<br>
<blockquote
cite="mid:CAE7YPDKq0E_bBRZkDkbp_3jUC=v7hs7k-KnU+VXVCN=BF7K0ww@mail.gmail.com"
type="cite"><br>
Another question, can you take a look at the metadata that I just
sent again? The structure is like:<br>
<br>
<md:EntityDescriptor
xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" entityID="<a
moz-do-not-send="true" href="http://www.localhost.com">www.localhost.com</a>"><br>
<md:SPSSODescriptor AuthnRequestsSigned="false"
WantAssertionsSigned="false" errorURL="<a moz-do-not-send="true"
href="http://www.localhost.com/SAML/ERROR">www.localhost.com/SAML/ERROR</a>"
</blockquote>
<br>
<br>
This is totally unrelated to your problem, but the SAML spec
mandates the use of absolute URI's pretty much everywhere, so you
really should have the http or https scheme on those. OpenSAML
won't care, but other code consuming the SAML that you generate
might.<br>
<br>
<br>
<blockquote
cite="mid:CAE7YPDKq0E_bBRZkDkbp_3jUC=v7hs7k-KnU+VXVCN=BF7K0ww@mail.gmail.com"
type="cite"><br>
<br>
There are two <KeyInfo>, I am using the same public key and
private key to generate it, so does is matter to use which one to
verify the signature? I think no, but I just want to rule out this
case.<br>
</blockquote>
<br>
<br>
It really depends on what you are trying to achieve. If you really
mean to sign the metadata with the entity's own key, then what you
say is correct, but that has implications for the trust model you
use with whomever consumes your metadata. To be technically
precise, the Signature/KeyInfo is the one that is the hint as to the
signing key (here for the metadata signature). The
KeyDescriptor/KeyInfo is the entity's own key that it uses for SAML
purposes, and in the real world is very often not the metadata
signing key.<br>
<br>
<br>
</body>
</html>