<html><head><meta http-equiv="Content-Type" content="text/html charset=iso-8859-1"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">Hi!<div><br></div><div><span class="Apple-tab-span" style="white-space:pre"> </span>I have a hard time figuring out how to validate the signature of a response for SSO. From what i have found on the net and the documentation i need to use a TrustEngine and a File MetaData Provider that will contains the the x.509 certificate to validate agains it. Each time, that i try to initialize the Mete Data Provider, i got a Java.lang.NullPointerException (Later Unable to marshall metadata).</div><div><br></div><div>Anyway here is my code:</div><div><div>String responseMessage = getContext().getRequest().getParameter("SAMLResponse").toString(); </div><div> </div><div><span class="Apple-tab-span" style="white-space:pre"> </span>DocumentBuilderFactory documentBuilderFactory = DocumentBuilderFactory.newInstance();</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>documentBuilderFactory.setNamespaceAware(true);</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>DocumentBuilder docBuilder = documentBuilderFactory.newDocumentBuilder();</div><div><span class="Apple-tab-span" style="white-space:pre"> </span></div><div> byte[] encodedRequestMessage = Base64.decode( responseMessage );</div><div><span class="Apple-tab-span" style="white-space:pre"> </span></div><div><span class="Apple-tab-span" style="white-space:pre"> </span>ByteArrayInputStream is=new ByteArrayInputStream(new String(encodedRequestMessage, "UTF-8").getBytes());</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>Document document = docBuilder.parse(is);</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>Element element = document.getDocumentElement();</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>UnmarshallerFactory unmarshallerFactory = Configuration.getUnmarshallerFactory();</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>Unmarshaller unmarshaller = unmarshallerFactory.getUnmarshaller(element);</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>Response response = (Response) unmarshaller.unmarshall(element);</div><div><span class="Apple-tab-span" style="white-space:pre"> </span></div><div> // INIT ONCE</div><div> FilesystemMetadataProvider idpMetaDataProvider = new FilesystemMetadataProvider(new File("/Volumes/Éléphant/apache/apache-tomcat-7.0.47/webapps/panelo/WEB-INF/classes/opensamlmetadata.xml")); </div><div><span class="Apple-tab-span" style="white-space:pre"> </span>idpMetaDataProvider.initialize();</div><div> MetadataProvider mdProvider = idpMetaDataProvider;</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>MetadataCredentialResolver mdCredResolver = new MetadataCredentialResolver(mdProvider);</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>KeyInfoCredentialResolver keyInfoCredResolver =</div><div><span class="Apple-tab-span" style="white-space:pre"> </span> Configuration.getGlobalSecurityConfiguration().getDefaultKeyInfoCredentialResolver();</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>ExplicitKeySignatureTrustEngine trustEngine = new ExplicitKeySignatureTrustEngine(mdCredResolver, keyInfoCredResolver);</div><div><span class="Apple-tab-span" style="white-space:pre"> </span> //INIT ONCE</div><div> </div><div> SAMLSignatureProfileValidator profileValidator = new SAMLSignatureProfileValidator();;</div><div> profileValidator.validate(response.getSignature());</div><div> </div><div> CriteriaSet criteriaSet = new CriteriaSet();</div><div> criteriaSet.add( new EntityIDCriteria(response.getIssuer().getValue()) );</div><div> criteriaSet.add( new MetadataCriteria(IDPSSODescriptor.DEFAULT_ELEMENT_NAME, SAMLConstants.SAML20P_NS) );</div><div> criteriaSet.add( new UsageCriteria(UsageType.SIGNING) );</div><div><br></div><div> if (!trustEngine.validate(response.getSignature(), criteriaSet)) </div><div> {</div><div> throw new Exception("Signature was either invalid or signing key could not be established as trusted");</div><div> }</div></div><div><br></div><div><br></div><div>Here is my meta data file:</div><div><div><?xml version="1.0" encoding="UTF-8" standalone="yes"?></div><div><span class="Apple-tab-span" style="white-space:pre"> </span><EntityDescriptor xmlns:xsi="<a href="https://www.w3.org/2001/XMLSchema-instance">https://www.w3.org/2001/XMLSchema-instance</a>" xmlns="urn:oasis:names:tc:SAML:2.0:metadata" entityID="<a href="https://wso2identity:9443/samlsso">https://wso2identity:9443/samlsso</a>"></div><div> <IDPSSODescriptor</div><div> WantAuthnRequestsSigned="false"</div><div> protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol"></div><div> </div><div><span class="Apple-tab-span" style="white-space:pre"> </span><KeyDescriptor use="signing"></div><div><span class="Apple-tab-span" style="white-space:pre"> </span><ds:KeyInfo xmlns:ds="<a href="http://www.w3.org/2000/09/xmldsig#">http://www.w3.org/2000/09/xmldsig#</a>"></div><div><span class="Apple-tab-span" style="white-space:pre"> </span><ds:X509Data></div><div><span class="Apple-tab-span" style="white-space:pre"> </span><ds:X509Certificate>MIICNTCCAZ6gAwIBAgIES343gjANBgkqhkiG9w0BAQUFADBVMQswCQYDVQQGEwJVUzELMAkGA1UECAwCQ0ExFjAUBgNVBAcMDU1vdW50YWluIFZpZXcxDTALBgNVBAoMBFdTTzIxEjAQBgNVBAMMCWxvY2FsaG9zdDAeFw0xMDAyMTkwNzAyMjZaFw0zNTAMTMwNzAyMjZaMFUxCzAJBgNVBAYTAlVTMQswCQYDVQQIDAJDQTEWMBQGA1UEBwwNTW91bnRhaW4gVmlldzENMAsGA1UECgwEV1NPMjESMBAGA1UEAwwJbG9jYWxob3N0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCUp/oV1vWc8/TkQSiAvTousMzOM4asB2iltr2QKozni5aVFu818MpOLZIr8LMnTzWllJvvaA5RAAdpbECb+48FjbBe0hseUdN5HpwvnH/DW8ZccGvk53I6Orq7hLCv1ZHtuOCokghz/ATrhyPq+QktMfXnRS4HrKGJTzxaCcU7OQIDAQABoxIwEDAOBgNVHQ8BAf8EBAMCBPAwDQYJKoZIhvcNAQEFBQADgYEAW5wPR7cr1LAdq+IrR44iQlRG5ITCZXY9hI0PygLP2rHANh+PYfTmxbuOnykNGyhM6FjFLbW2uZHQTY1jMrPprjOrmyK5sjJRO4d1DeGHT/YnIjs9JogRKv4XHECwLtIVdAbIdWHEtVZJyMSktcyysFcvuhPQK8Qc/E/Wq8uHSCo=</ds:X509Certificate></div><div><span class="Apple-tab-span" style="white-space:pre"> </span></ds:X509Data></div><div><span class="Apple-tab-span" style="white-space:pre"> </span></ds:KeyInfo></div><div><span class="Apple-tab-span" style="white-space:pre"> </span></KeyDescriptor> </div><div> </div><div> <!-- Supported Name Identifier Formats --></div><div> <NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</NameIDFormat></div><div> </div><div> <!-- AuthenticationRequest Consumer endpoint --></div><div> <SingleSignOnService</div><div> Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"</div><div> Location="<a href="http://wso2identity:9443/samlsso">http://wso2identity:9443/samlsso</a>"</div><div> index="0" </div><div> isDefault="true"</div><div> /></div><div> </div><div> </IDPSSODescriptor></div><div></EntityDescriptor></div></div><div><br></div><div>Here is the stack trace:</div><div><br></div><div><pre>org.opensaml.saml2.metadata.provider.MetadataProviderException: Unable to unmarshall metadata
org.opensaml.saml2.metadata.provider.AbstractReloadingMetadataProvider.unmarshallMetadata(AbstractReloadingMetadataProvider.java:308)
org.opensaml.saml2.metadata.provider.AbstractReloadingMetadataProvider.processNewMetadata(AbstractReloadingMetadataProvider.java:345)
org.opensaml.saml2.metadata.provider.AbstractReloadingMetadataProvider.refresh(AbstractReloadingMetadataProvider.java:261)
org.opensaml.saml2.metadata.provider.AbstractReloadingMetadataProvider.doInitialization(AbstractReloadingMetadataProvider.java:236)
org.opensaml.saml2.metadata.provider.AbstractMetadataProvider.initialize(AbstractMetadataProvider.java:407)
com.mnubo.panelo.LoginActionBean.log(LoginActionBean.java:302)
sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)
sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
java.lang.reflect.Method.invoke(Method.java:606)
net.sourceforge.stripes.controller.DispatcherHelper$6.intercept(DispatcherHelper.java:456)
net.sourceforge.stripes.controller.ExecutionContext.proceed(ExecutionContext.java:158)
org.stripesstuff.plugin.security.SecurityInterceptor.interceptEventHandling(SecurityInterceptor.java:196)
org.stripesstuff.plugin.security.SecurityInterceptor.intercept(SecurityInterceptor.java:126)
net.sourceforge.stripes.controller.ExecutionContext.proceed(ExecutionContext.java:155)
com.mnubo.panelo.interceptor.EventHandlerInterceptor.intercept(EventHandlerInterceptor.java:26)
net.sourceforge.stripes.controller.ExecutionContext.proceed(ExecutionContext.java:155)
net.sourceforge.stripes.controller.BeforeAfterMethodInterceptor.intercept(BeforeAfterMethodInterceptor.java:113)
net.sourceforge.stripes.controller.ExecutionContext.proceed(ExecutionContext.java:155)
net.sourceforge.stripes.controller.ExecutionContext.wrap(ExecutionContext.java:74)
net.sourceforge.stripes.controller.DispatcherHelper.invokeEventHandler(DispatcherHelper.java:454)
net.sourceforge.stripes.controller.DispatcherServlet.invokeEventHandler(DispatcherServlet.java:278)
net.sourceforge.stripes.controller.DispatcherServlet.service(DispatcherServlet.java:160)
javax.servlet.http.HttpServlet.service(HttpServlet.java:728)
net.sourceforge.stripes.controller.StripesFilter.doFilter(StripesFilter.java:260)
org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:51)
</pre><div style="font-family: Tahoma, Arial, sans-serif; background-color: rgb(255, 255, 255);"><br class="webkit-block-placeholder"></div><p style="font-family: Tahoma, Arial, sans-serif; background-color: rgb(255, 255, 255);"><b style="color: white; background-color: rgb(82, 93, 118);">cause mère</b></p><pre>org.opensaml.xml.io.UnmarshallingException: java.lang.NullPointerException
org.opensaml.saml2.metadata.provider.AbstractMetadataProvider.unmarshallMetadata(AbstractMetadataProvider.java:473)
org.opensaml.saml2.metadata.provider.AbstractReloadingMetadataProvider.unmarshallMetadata(AbstractReloadingMetadataProvider.java:304)
org.opensaml.saml2.metadata.provider.AbstractReloadingMetadataProvider.processNewMetadata(AbstractReloadingMetadataProvider.java:345)
org.opensaml.saml2.metadata.provider.AbstractReloadingMetadataProvider.refresh(AbstractReloadingMetadataProvider.java:261)
org.opensaml.saml2.metadata.provider.AbstractReloadingMetadataProvider.doInitialization(AbstractReloadingMetadataProvider.java:236)
org.opensaml.saml2.metadata.provider.AbstractMetadataProvider.initialize(AbstractMetadataProvider.java:407)
com.mnubo.panelo.LoginActionBean.log(LoginActionBean.java:302)
sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)
sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
java.lang.reflect.Method.invoke(Method.java:606)
net.sourceforge.stripes.controller.DispatcherHelper$6.intercept(DispatcherHelper.java:456)
net.sourceforge.stripes.controller.ExecutionContext.proceed(ExecutionContext.java:158)
org.stripesstuff.plugin.security.SecurityInterceptor.interceptEventHandling(SecurityInterceptor.java:196)
org.stripesstuff.plugin.security.SecurityInterceptor.intercept(SecurityInterceptor.java:126)
net.sourceforge.stripes.controller.ExecutionContext.proceed(ExecutionContext.java:155)
com.mnubo.panelo.interceptor.EventHandlerInterceptor.intercept(EventHandlerInterceptor.java:26)
net.sourceforge.stripes.controller.ExecutionContext.proceed(ExecutionContext.java:155)
net.sourceforge.stripes.controller.BeforeAfterMethodInterceptor.intercept(BeforeAfterMethodInterceptor.java:113)
net.sourceforge.stripes.controller.ExecutionContext.proceed(ExecutionContext.java:155)
net.sourceforge.stripes.controller.ExecutionContext.wrap(ExecutionContext.java:74)
net.sourceforge.stripes.controller.DispatcherHelper.invokeEventHandler(DispatcherHelper.java:454)
net.sourceforge.stripes.controller.DispatcherServlet.invokeEventHandler(DispatcherServlet.java:278)
net.sourceforge.stripes.controller.DispatcherServlet.service(DispatcherServlet.java:160)
javax.servlet.http.HttpServlet.service(HttpServlet.java:728)
net.sourceforge.stripes.controller.StripesFilter.doFilter(StripesFilter.java:260)
org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:51)
</pre><div style="font-family: Tahoma, Arial, sans-serif; background-color: rgb(255, 255, 255);"><br class="webkit-block-placeholder"></div><p style="font-family: Tahoma, Arial, sans-serif; background-color: rgb(255, 255, 255);"><b style="color: white; background-color: rgb(82, 93, 118);">cause mère</b></p><pre>java.lang.NullPointerException
org.opensaml.saml2.metadata.provider.AbstractMetadataProvider.unmarshallMetadata(AbstractMetadataProvider.java:460)
org.opensaml.saml2.metadata.provider.AbstractReloadingMetadataProvider.unmarshallMetadata(AbstractReloadingMetadataProvider.java:304)
org.opensaml.saml2.metadata.provider.AbstractReloadingMetadataProvider.processNewMetadata(AbstractReloadingMetadataProvider.java:345)
org.opensaml.saml2.metadata.provider.AbstractReloadingMetadataProvider.refresh(AbstractReloadingMetadataProvider.java:261)
org.opensaml.saml2.metadata.provider.AbstractReloadingMetadataProvider.doInitialization(AbstractReloadingMetadataProvider.java:236)
org.opensaml.saml2.metadata.provider.AbstractMetadataProvider.initialize(AbstractMetadataProvider.java:407)
com.mnubo.panelo.LoginActionBean.log(LoginActionBean.java:302)
sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)
sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
java.lang.reflect.Method.invoke(Method.java:606)
net.sourceforge.stripes.controller.DispatcherHelper$6.intercept(DispatcherHelper.java:456)
net.sourceforge.stripes.controller.ExecutionContext.proceed(ExecutionContext.java:158)
org.stripesstuff.plugin.security.SecurityInterceptor.interceptEventHandling(SecurityInterceptor.java:196)
org.stripesstuff.plugin.security.SecurityInterceptor.intercept(SecurityInterceptor.java:126)
net.sourceforge.stripes.controller.ExecutionContext.proceed(ExecutionContext.java:155)
com.mnubo.panelo.interceptor.EventHandlerInterceptor.intercept(EventHandlerInterceptor.java:26)
net.sourceforge.stripes.controller.ExecutionContext.proceed(ExecutionContext.java:155)
net.sourceforge.stripes.controller.BeforeAfterMethodInterceptor.intercept(BeforeAfterMethodInterceptor.java:113)
net.sourceforge.stripes.controller.ExecutionContext.proceed(ExecutionContext.java:155)
net.sourceforge.stripes.controller.ExecutionContext.wrap(ExecutionContext.java:74)
net.sourceforge.stripes.controller.DispatcherHelper.invokeEventHandler(DispatcherHelper.java:454)
net.sourceforge.stripes.controller.DispatcherServlet.invokeEventHandler(DispatcherServlet.java:278)
net.sourceforge.stripes.controller.DispatcherServlet.service(DispatcherServlet.java:160)
javax.servlet.http.HttpServlet.service(HttpServlet.java:728)
net.sourceforge.stripes.controller.StripesFilter.doFilter(StripesFilter.java:260)
org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:51)
</pre><div style="font-family: Tahoma, Arial, sans-serif; background-color: rgb(255, 255, 255);"><br class="webkit-block-placeholder"></div><p style="font-family: Tahoma, Arial, sans-serif; background-color: rgb(255, 255, 255);"><b style="color: white; background-color: rgb(82, 93, 118);">note</b> <u>La trace complète de la cause mère de cette erreur est disponible dans les fichiers journaux de Apache Tomcat/7.0.</u></p><div><br></div></div><div>If anyone could help, it would be appreciated. The archive of the mailing list is not working so i was not able to see if the same question has been raised before.</div><div><br></div><div>Thanks in advance.</div><div><br></div><div>Yann Bourdeau</div></body></html>
<br>
<p><span style="background-color:white"><font color="#808080" face="Arial" size="2">CONFIDENTIALITY: This e-mail message (including attachments,
if any) is confidential and is intended only for the addressee. Any
unauthorized use or disclosure is strictly prohibited. Disclosure of this
e-mail to anyone other than the intended addressee does not constitute waiver
of privilege. If you have received this communication in error, please notify
us immediately and delete this. Thank you for your cooperation. This message has not been encrypted. Special arrangements can be made for
encryption upon request.</font></span></p>
<p><span lang="FR-CA"><span style="background-color:white"><font color="#808080" face="Arial" size="2">CONFIDENTIALITÉ: Ce message courriel (y compris les pièces
jointes, le cas échéant) est confidentiel et destiné uniquement à la personne
ou à l'entité à qui il est adressé. Toute
utilisation ou divulgation non permise est strictement interdite. L'obligation de confidentialité et de secret
professionnel demeure malgré toute divulgation.
Si vous avez reçu le présent courriel et ses annexes par erreur,
veuillez nous en informer immédiatement et le détruire. Nous vous remercions de votre
collaboration. Le présent message n'a
pas été crypté. Le cryptage est possible
sur demande spéciale.</font></span><font face="Arial, Helvetica, sans-serif" style="font-size:1.3em"></font></span></p>