<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<br>
<div class="moz-cite-prefix">On 12/3/12 8:57 PM, Li Run wrote:<br>
</div>
<blockquote
cite="mid:CBECC7E3A142D8418DAA17E4659FF9F101FE22E2BE40@CROEXCFWP04.gemalto.com"
type="cite">
<meta http-equiv="Content-Type" content="text/html;
charset=ISO-8859-1">
<meta name="Generator" content="Microsoft Word 12 (filtered
medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:\5B8B\4F53;
panose-1:2 1 6 0 3 1 1 1 1 1;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"\@\5B8B\4F53";
panose-1:2 1 6 0 3 1 1 1 1 1;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.25in 1.0in 1.25in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
<div class="WordSection1">
<p class="MsoNormal">Hi, all<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I’m using OpenSAML to test some SAML1.1
sso. When I get a saml response from the server, I try to
validate the signature of the saml assertion, but I always get
the “Signature verification failed” error.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">My code is like:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<br>
</div>
</blockquote>
<br>
Assuming that the correct signing/validation key is included in the
Signature's KeyInfo, this code should work as far as the mechanical
cryptographic validation of the signature. (Note that it is
critical to also establish trust of the key - you can not just trust
the key supplied in the message. But that is not related to your
problem.)<br>
<br>
<br>
<blockquote
cite="mid:CBECC7E3A142D8418DAA17E4659FF9F101FE22E2BE40@CROEXCFWP04.gemalto.com"
type="cite">
<div class="WordSection1"><o:p></o:p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Anyone know where is the problem? Or could
anybody give me a correct saml response so that I can make
sure my code is written in right way?</p>
</div>
</blockquote>
<br>
<br>
See this page on signature troubleshooting.<br>
<br>
<a class="moz-txt-link-freetext" href="https://wiki.shibboleth.net/confluence/display/OpenSAML/OSTwoUserManSigErrors">https://wiki.shibboleth.net/confluence/display/OpenSAML/OSTwoUserManSigErrors</a><br>
<br>
<br>
Assuming that the key is correct, the problem is most likely that
the signed document is being changed sometime between when it is
signed by the sender and when you validate it. Likely culprits are
pretty-print formatting the XML or other mutations of the DOM after
it is parsed.<br>
<br>
</body>
</html>