<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<br>
<div class="moz-cite-prefix">On 12/15/14 1:22 PM, Sandy wrote:<br>
</div>
<blockquote
cite="mid:CA+4cBy5DtUTzoVvm9ORhmMR3jE-0f9Qo8U9czbhUxAZm5S+www@mail.gmail.com"
type="cite">
<div dir="ltr">
<div>
<div>
<div>
<div>
<div>
<div><br>
<br>
</div>
1. Is it a good practice to use the public key from
the SAML assertion?<br>
</div>
</div>
</div>
</div>
</div>
</div>
</blockquote>
<br>
That's a complicated question. The short answer is, you can
literally extract the key from the Signature's KeyInfo and
cryptographically verify the signature with it - but you can't
*only* do that. One way or another, you have to verify the trust of
the key using out-of-band information, such as SAML metadata.<br>
<br>
<blockquote
cite="mid:CA+4cBy5DtUTzoVvm9ORhmMR3jE-0f9Qo8U9czbhUxAZm5S+www@mail.gmail.com"
type="cite">
<div dir="ltr">
<div>
<div>
<div>
<div>2. If yes, are there any existing utility methods -
that I'm unaware of - to create or validate the
signature without having to append and pre-pend the
markers.<br>
</div>
</div>
</div>
</div>
</div>
</blockquote>
<br>
Yes, there are lots of ways to build the cert from the
base64-encoded DER without the PEM headers/footers. Those are not
really part of the encoding. You didn't say what your SP is built
with, but if it's OpenSAML Java (or I assume also C++) then we have
helpers in xmltooling for that purposes. But we also have higher
level components, for example which resolve a Credential from a
KeyInfo, or which wrap that in the entire trust-establishment
process (TrustEngine).<br>
<br>
<blockquote
cite="mid:CA+4cBy5DtUTzoVvm9ORhmMR3jE-0f9Qo8U9czbhUxAZm5S+www@mail.gmail.com"
type="cite">
<div dir="ltr">
<div>
<div>
<div>3. Why are the markers stripped off from the
x509certificate in idp-metadata.xml.<br>
</div>
</div>
</div>
</div>
</blockquote>
<br>
They're not specified nor allowed by the spec which defines the
KeyInfo structure (the XML Signature specification).<br>
<br>
The headers/footers that you're calling "markers" are from PEM
format, used on disk, in MIME email, etc. The use case here doesn't
specify that format.<br>
<br>
<blockquote
cite="mid:CA+4cBy5DtUTzoVvm9ORhmMR3jE-0f9Qo8U9czbhUxAZm5S+www@mail.gmail.com"
type="cite">
<div dir="ltr">
<div>
<div>
<div><br>
</div>
<div>For the record, I have followed <br>
<br>
<a moz-do-not-send="true"
href="https://wiki.shibboleth.net/confluence/display/OpenSAML/OSTwoUserManJavaDSIG"
target="_blank">https://wiki.shibboleth.net/confluence/display/OpenSAML/OSTwoUserManJavaDSIG</a>
<br>
<br>
page, which was helpful, but the method call
'getVerificationCredential()' was not clear, which is what
I was trying to implement.<br>
</div>
</div>
</div>
</div>
<br>
</blockquote>
<br>
Ok. It's deliberately left unclear, b/c it's just a sketch of the
API. You typically wouldn't want to actually do that in the real
world, at least not *just* that. Note the big red box above about
"Trust Establishment", don't ignore that.<br>
<br>
The more complex example below that with the TrustEngine is
conceptually what you really have to do. There's layers of
abstraction in there, but ultimately you have to verify the trust of
the signing key or else you have zero security. You can't just
trust what is in the Signature's KeyInfo. <br>
<br>
</body>
</html>