<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<br>
<div class="moz-cite-prefix">On 12/29/14 2:48 PM,
<a class="moz-txt-link-abbreviated" href="mailto:Stephen.CTR.Chappell@faa.gov">Stephen.CTR.Chappell@faa.gov</a> wrote:<br>
</div>
<blockquote
cite="mid:2AF57F3BA98ED14499D518E94F44EA5D1D623818@006FCH1MPN2-021.006f.mgd2.msft.net"
type="cite">
<meta http-equiv="Content-Type" content="text/html;
charset=windows-1252">
<meta name="Generator" content="Microsoft Word 14 (filtered
medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
{mso-style-priority:99;
mso-style-link:"Balloon Text Char";
margin:0in;
margin-bottom:.0001pt;
font-size:8.0pt;
font-family:"Tahoma","sans-serif";}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
span.BalloonTextChar
{mso-style-name:"Balloon Text Char";
mso-style-priority:99;
mso-style-link:"Balloon Text";
font-family:"Tahoma","sans-serif";}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
<div class="WordSection1">
<p class="MsoNormal">I had thought that iterating over the
ContentReference list in the
org.opensaml.xml.signature.Signature would let me validate the
digest algorithms, if the references were cast to a
SAMLObjectContentReference, like so:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</blockquote>
<br>
No, unfortunately not. In both v2 and v3 since most of the
signature support is based on Apache Santuario, we don't really
fully unmarshall the original DOM Element data to Java objects. The
Signature XMLObject impl is kind of the oddball of all our XMLObject
provider impls.<br>
<br>
<br>
<br>
<blockquote
cite="mid:2AF57F3BA98ED14499D518E94F44EA5D1D623818@006FCH1MPN2-021.006f.mgd2.msft.net"
type="cite">
<div class="WordSection1"><o:p></o:p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">While it seems that the content references
are initialized (the transforms appear to be correct, the
signableObject points to the Assertion, etc), the
digestAlgorithm is set to a default value (<a
moz-do-not-send="true"
href="http://www.w3.org/2000/09/xmldsig#sha1">http://www.w3.org/2000/09/xmldsig#sha1</a>”,
which is not what is used in the Assertion.</p>
</div>
</blockquote>
<br>
I actually think in both cases you're just seeing the content
reference defaults. The transform ones just happen to be correct
for your example data. I don't think we do anything to populate
those on unmarshalling, as I said above.<br>
<br>
<br>
<blockquote
cite="mid:2AF57F3BA98ED14499D518E94F44EA5D1D623818@006FCH1MPN2-021.006f.mgd2.msft.net"
type="cite">
<div class="WordSection1">
<p class="MsoNormal"><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Is there a way to retrieve the actual
digest method that was used? I could just parse the original
SOAPElement, but if there is an OpenSAML-ish way to go about
it that would be helpful.<br>
</p>
</div>
</blockquote>
<br>
<br>
In v3 we actually have a new similar feature, in that we support an
algorithm whitelist/blacklist eval. For that, we just evaluate the
Signature DOM Element directly:<br>
<br>
<a class="moz-txt-link-freetext" href="http://svn.shibboleth.net/view/java-opensaml/trunk/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/support/impl/SignatureAlgorithmValidator.java?revision=3984&view=markup">http://svn.shibboleth.net/view/java-opensaml/trunk/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/support/impl/SignatureAlgorithmValidator.java?revision=3984&view=markup</a><br>
<br>
<br>
</body>
</html>