Thanks Brent. There is another general signature related question I want to know. If I understand correctly, the mechanism work in this way:<br><br>1. On IdP side, it creates an Assertion, and generates a signature based on this assertion<br>
2. IdP send the Assertion and signature to SP side.<br>3. When SP tries to validate the signature, theoretically it needs to:<br> a. make sure the signature is generated by the private key of the IdP<br> b. make sure the message is not modified by comparing the digest value of the assertion and decrypted signature.<br>
<br>The method validateSignature(Signature signature, Credential validatingCredential) seems to only do the step (a), could you please tell me where and how we do step (b)? Maybe the Signature object contains some extra information than I imagined?<br>
<br>Thanks,<br clear="all">Yaowen<br>
<br><br><div class="gmail_quote">On Tue, Nov 6, 2012 at 12:11 PM, Brent Putman <span dir="ltr"><<a href="mailto:putmanb@georgetown.edu" target="_blank">putmanb@georgetown.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div class="im"><br>
On 11/6/12 2:30 PM, Yaowen Tu wrote:<br>
> Hi,<br>
><br>
> When I try to validate the signature of a decrypted assertion, I got<br>
> the following exception:<br>
><br>
> Caused by: org.opensaml.xml.validation.ValidationException: Apache<br>
> xmlsec IdResolver could not resolve the Element for id reference:<br>
> _83f4c0d593d29a106d35d59acc15da2b<br>
> at<br>
> org.opensaml.security.SAMLSignatureProfileValidator.validateReferenceURI(SAMLSignatureProfileValidator.java:153)<br>
> at<br>
> org.opensaml.security.SAMLSignatureProfileValidator.validateSignatureImpl(SAMLSignatureProfileValidator.java:84)<br>
> at<br>
> org.opensaml.security.SAMLSignatureProfileValidator.validate(SAMLSignatureProfileValidator.java:56)<br>
><br>
<br>
<br>
</div>This is basically the issue that is highlighted in the big red warning<br>
box directly underneath this spot in the wiki:<br>
<br>
<a href="https://wiki.shibboleth.net/confluence/display/OpenSAML/OSTwoUserManJavaXMLEncryption#OSTwoUserManJavaXMLEncryption-CreateaSAML2Decrypter" target="_blank">https://wiki.shibboleth.net/confluence/display/OpenSAML/OSTwoUserManJavaXMLEncryption#OSTwoUserManJavaXMLEncryption-CreateaSAML2Decrypter</a><br>
<br>
For the details, please see the Javadocs as noted there.<br>
<div class="im"><br>
<br>
<br>
> My code is:<br>
> //The getAssertion method will decrypt the assertion from<br>
> the response<br>
> Assertion assertion = getAssertion( response );<br>
><br>
> if( assertion.isSigned() )<br>
> {<br>
> // Now we must validate the signature of the assertion<br>
> Signature signatureToValidate = assertion.getSignature();<br>
> // Now try to validate. Throw exception if not valid.<br>
> super.validateSignature( signatureToValidate,<br>
> validatingCredential);<br>
> }<br>
><br>
> public void validateSignature(Signature signature, Credential<br>
> validatingCredential) throws ValidationException<br>
> {<br>
> SAMLSignatureProfileValidator profileValidator = new<br>
> SAMLSignatureProfileValidator();<br>
> profileValidator.validate( signature );<br>
><br>
> SignatureValidator signatureValidator = new<br>
> SignatureValidator( validatingCredential );<br>
> signatureValidator.validate( signature );<br>
> }<br>
><br>
<br>
<br>
</div>That looks fine, at least as far as mechanically validating the<br>
signature (still need to establish trust of the validation key, but<br>
perhaps you are doing that elsewhere). The issue isn't with how you're<br>
validating the signature, but rather with how it is being decrypted and<br>
some things that happen at the DOM level. The info I reference above<br>
above should explain why.<br>
<br>
<br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:dev-unsubscribe@shibboleth.net">dev-unsubscribe@shibboleth.net</a><br>
</blockquote></div><br>