<div dir="ltr"><div><div><div><div>Update:<br><br></div>I was able to get past the error. It was an error from my side. We were using opensaml v 2.6.3 and xmltooling v.1.4.3, the latest versions when we started the development. XMLtooling v.1.4.3 depends on not-yet-commons-ssl v. 0.3.9. For some unknown reason or due to error, our maven was configured to depend on not-yet-commons-ssl v.0.3.11. I noticed it and changed it to v.0.3.9 and the exception went away and everything worked fine. Bottom line, use the same version that xmltooling library originally used.<br><br></div>So, question 2 from my previous mail is now cleared, but question 1 still puzzles me. In my implementation, I was able to validate by extracting just the x509cert from my trust store(i.e. without adding a private key to the BasicX509Credential), but the validation in the unit test(explained in my earlier mail) fails, when I comment out addition of private key to the signingX509Cred(BasicX509Credential). Any pointers will be helpful and are appreciated.<br><br></div>Thank you for the help. Have a great day!<br><br></div>Regards,<br>Sundeep<br><div><div><br><div><div><div><br></div></div></div></div></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Wed, Dec 17, 2014 at 7:26 PM, Sandy <span dir="ltr"><<a href="mailto:sundeep.nitw@gmail.com" target="_blank">sundeep.nitw@gmail.com</a>></span> wrote:<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div><div><div><div>Hello Brent,<br><br></div>I have been able to validate the signature successfully and am now working on establishing trust. I am using ExplicitKeySignatureTrustEngine as it suits my needs like you suggested. I have not been successful with this and have a few questions that might clear my understanding and hence my way.<br><br></div>1. In the xmltooling test, <b>testSuccess()</b> in <i>ExplicitKeySignatureTrustEngineTest </i>(org.opensaml.xml.signature.ExplicitKeySignatureTrustEngineTest), during setUp(), we create <span style="background-color:rgb(255,228,255)">signingX509Cred</span> of type <span style="background-color:rgb(228,228,255)">BasicX509Credential</span> and set a private key to it. If I understood the test correctly, the test(and <span style="background-color:rgb(228,228,255)">ExplicitKeySignatureTrustEngine</span>) uses the trusting credentials supplied as a list(<span style="background-color:rgb(255,228,255)">trustedCredentials</span>) as opposed to the default trust store. My understanding is that a trust store does not require a private key. If I comment out adding the private key(<span style="background-color:rgb(255,228,255)">signingPrivateKey</span>), the test fails. Either my understanding of the test is wrong, or I am missing something by a long shot. Hope I put my confusion clearly.<br><br></div>2. In my implementation for establishing trust, I am running into an exception(pasted at the bottom for legibility). I found <a href="http://comments.gmane.org/gmane.comp.web.shibboleth.devel/4222" target="_blank">this related discussion from 2013</a>. By any chance, have you come across the root cause for this? I debugged through the error and found that the failure is at org.apache.commons.ssl.KeyStoreBuilder.parse(byte[], char[], char[]) of the not-yet-commons-ssl library. Apparently, it was not able to return a BuildResult object and throws the exception at the end. <br><br></div><div>Thank you for your patience and help.<br><br></div><div>Regards,<br></div><div>Sundeep<br></div><div><br></div><div>Exception stack trace:<br></div><div><br>org.opensaml.xml.security.SecurityException: Error extracting certificates from X509Data<br> at org.opensaml.xml.security.keyinfo.provider.InlineX509DataProvider.extractCertificates(InlineX509DataProvider.java:195)<br> at org.opensaml.xml.security.keyinfo.provider.InlineX509DataProvider.process(InlineX509DataProvider.java:126)<br> at org.opensaml.xml.security.keyinfo.BasicProviderKeyInfoCredentialResolver.processKeyInfoChild(BasicProviderKeyInfoCredentialResolver.java:300)<br> at org.opensaml.xml.security.keyinfo.BasicProviderKeyInfoCredentialResolver.processKeyInfoChildren(BasicProviderKeyInfoCredentialResolver.java:256)<br> at org.opensaml.xml.security.keyinfo.BasicProviderKeyInfoCredentialResolver.processKeyInfo(BasicProviderKeyInfoCredentialResolver.java:190)<br> at org.opensaml.xml.security.keyinfo.BasicProviderKeyInfoCredentialResolver.resolveFromSource(BasicProviderKeyInfoCredentialResolver.java:149)<br> at org.opensaml.xml.security.credential.AbstractCriteriaFilteringCredentialResolver.resolve(AbstractCriteriaFilteringCredentialResolver.java:57)<br> at org.opensaml.xml.security.credential.AbstractCriteriaFilteringCredentialResolver.resolve(AbstractCriteriaFilteringCredentialResolver.java:37)<br> at org.opensaml.xml.signature.impl.BaseSignatureTrustEngine.validate(BaseSignatureTrustEngine.java:99)<br> at org.opensaml.xml.signature.impl.ExplicitKeySignatureTrustEngine.validate(ExplicitKeySignatureTrustEngine.java:100)<br></div> //.. Lines omitted<br><div>Caused by: java.security.cert.CertificateException: Unable to decode X.509 certificates<br> at org.opensaml.xml.security.x509.X509Util.decodeCertificate(X509Util.java:362)<br> at org.opensaml.xml.security.keyinfo.KeyInfoHelper.getCertificate(KeyInfoHelper.java:201)<br> at org.opensaml.xml.security.keyinfo.KeyInfoHelper.getCertificates(KeyInfoHelper.java:176)<br> at org.opensaml.xml.security.keyinfo.provider.InlineX509DataProvider.extractCertificates(InlineX509DataProvider.java:192)<br> ... 34 more<br>Caused by: java.security.KeyStoreException: failed to extract any certificates or private keys - maybe bad password?<br> at org.apache.commons.ssl.KeyStoreBuilder.parse(KeyStoreBuilder.java:443)<br> at org.apache.commons.ssl.TrustMaterial.<init>(TrustMaterial.java:213)<br> at org.apache.commons.ssl.TrustMaterial.<init>(TrustMaterial.java:165)<br> at org.opensaml.xml.security.x509.X509Util.decodeCertificate(X509Util.java:359)<br> ... 37 more<br><div><div><div><div bgcolor="#FFFFFF"></div><br></div></div></div></div></div><div class="gmail_extra"><br><div class="gmail_quote"><div><div class="h5">On Mon, Dec 15, 2014 at 9:24 PM, Brent Putman <span dir="ltr"><<a href="mailto:putmanb@georgetown.edu" target="_blank">putmanb@georgetown.edu</a>></span> wrote:</div></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div><div class="h5">
<div bgcolor="#FFFFFF" text="#000000"><span>
<br>
<div>On 12/15/14 2:51 PM, Sandy wrote:<br>
</div>
<blockquote type="cite">
<div dir="ltr">
<div>
<div>
<div>
<div>Thank you Brent.<br>
<br>
</div>
The SP is built with OpenSAML Java(2.6.3). Like you
correctly guessed, at the moment I am looking to resolve a
Credential from KeyInfo. </div>
</div>
</div>
</div>
</blockquote>
<br></span>
We have a KeyInfoCredentialResolver exactly for that purpose.
That's an interface. For the signature validation processing case,
the main impl to look at is:<br>
org.opensaml.xml.security.keyinfo.BasicProviderKeyInfoCredentialResolver.<br>
<br>
You can get a basic instance of that with the typical providers
already wired in (suitable for your use case) from:<br>
Configuration.getGlobalSecurityConfiguration().getDefaultKeyInfoCredentialResolver()<br>
<br>
The unit tests should give you usage examples.<span><br>
<br>
<br>
<br>
<blockquote type="cite">
<div dir="ltr">
<div>
<div>
<div><br>
</div>
Thank you for the advise on establishing trust. I now
understand how important it is and I would implement it. The
more complex example at the bottom serves as a great
resource for this. <br>
<br>
</div>
</div>
</div>
</blockquote>
<br></span>
That example illustrates the trust establishment using SAML
metadata, b/c that is the trusted CredentialResolver that is
specified. If you wanted to use a different source of trusted
Credentials for the ExplicitKeySignatureTrustEngine, you would just
swap out the metadata-based one for a different one. There are
several CredentialResolver impls.<span><br>
<br>
<br>
<blockquote type="cite">
<div dir="ltr">
<div>If there happen to be examples citing the usage of
credential resolvers and a basic signature trust engine, it
would be great to know them. I plan on using a local trust
store at the SP for establishing the trust.<br>
</div>
</div>
</blockquote>
<br></span>
Well, that example in the wiki is pretty complete, as far as just
using the trust engine. Other than that, there's just unit tests
and the Shibboleth IdP, which is built on top of all of this. I
don't know what exactly you want to know, but if you have specific
questions, just post them here.<span><font color="#888888"><br>
<br>
--Brent<br>
<br>
</font></span></div>
<br></div></div><span class="HOEnZb"><font color="#888888">--<br>
To unsubscribe from this list send an email to <a href="mailto:dev-unsubscribe@shibboleth.net" target="_blank">dev-unsubscribe@shibboleth.net</a><br></font></span></blockquote></div></div>
</blockquote></div></div>