<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<br>
<div class="moz-cite-prefix">On 5/9/13 1:56 PM, Mitu Singh wrote:<br>
</div>
<blockquote
cite="mid:1368122192.51330.YahooMailNeo@web122004.mail.ne1.yahoo.com"
type="cite">
<div style="color:#000; background-color:#fff; font-family:tahoma,
new york, times, serif;font-size:10pt">
<div id="yiv8852456821">
<div>
<div
style="color:#000;background-color:#fff;font-family:tahoma,
new york, times, serif;font-size:10pt;">
<div id="yiv8852456821yui_3_7_2_28_1368055660293_39">Hello,</div>
<div id="yiv8852456821yui_3_7_2_28_1368055660293_57"><br>
</div>
<div style="color:rgb(0, 0,
0);font-size:13.3333px;font-family:tahoma, new york,
times,
serif;background-color:transparent;font-style:normal;"
id="yiv8852456821yui_3_7_2_28_1368055660293_59">I am
implementing Service Provider using opensaml. The
Service Provider works very well when deployed on
tomcat. But when I deploy it on Jboss, I get the
following error while validating signature:</div>
<div id="yiv8852456821yui_3_7_2_28_1368055660293_98"
style="color:rgb(0, 0,
0);font-size:13.3333px;font-family:tahoma, new york,
times,
serif;background-color:transparent;font-style:normal;">ERROR
[org.opensaml.security.SAMLSignatureProfileValidator]
Apache xmlsec IdResolver could not resolve the Element
for id reference:</div>
</div>
</div>
</div>
</div>
</blockquote>
<br>
What that error literally means is that it can't find the DOM
Element pointed to by the signature's Reference URI. It basically
uses Document#getElementById(id), where id is the value from the
Reference URI attribute, without the leading '#'. <br>
<br>
<blockquote
cite="mid:1368122192.51330.YahooMailNeo@web122004.mail.ne1.yahoo.com"
type="cite">
<div style="color:#000; background-color:#fff; font-family:tahoma,
new york, times, serif;font-size:10pt">
<div id="yiv8852456821">
<div>
<div
style="color:#000;background-color:#fff;font-family:tahoma,
new york, times, serif;font-size:10pt;">
<div id="yiv8852456821yui_3_7_2_28_1368055660293_102"
style="color:rgb(0, 0,
0);font-size:13.3333px;font-family:tahoma, new york,
times,
serif;background-color:transparent;font-style:normal;"><br
id="yiv8852456821yui_3_7_2_28_1368055660293_107">
</div>
<div id="yiv8852456821yui_3_7_2_28_1368055660293_104"
style="color:rgb(0, 0,
0);font-size:13.3333px;font-family:tahoma, new york,
times,
serif;background-color:transparent;font-style:normal;">I
am using Jboss7.1.1.Final. Has anybody else seen this
issue? How can I fix this.<br>
<br>
</div>
</div>
</div>
</div>
</div>
</blockquote>
<br>
As Paul mentioned, it's likely that it's not JBoss vs Tomcat per se,
but rather a difference in the XML parsing environments, perhaps
related to differing versions of endorsed libraries. Although I
wouldn't think that not endorsing would cause this problem, unless
JBoss is using a really old and/or broken version of Xerces.<br>
<br>
I suppose you should also verify the obvious: that the signed thing
(e.g. Assertion or Response) has a valid ID attribute with a
non-empty value, and that the Reference URI validly refers to that
same ID value.<br>
<br>
--Brent<br>
<br>
<br>
</body>
</html>