<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
{mso-style-priority:99;
mso-style-link:"Balloon Text Char";
margin:0in;
margin-bottom:.0001pt;
font-size:8.0pt;
font-family:"Tahoma","sans-serif";}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
span.BalloonTextChar
{mso-style-name:"Balloon Text Char";
mso-style-priority:99;
mso-style-link:"Balloon Text";
font-family:"Tahoma","sans-serif";}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal">I have a requirement to validate that the digest algorithm used in an Assertion’s signature conforms with our profile, but I’m having some trouble retrieving the digest algorithm that was used using OpenSaml 2.6. To start, I have a org.opensaml.saml2.core.Assertion
built from a SOAPElement. After validating the signature, I am trying to do further validations. I had thought that iterating over the ContentReference list in the org.opensaml.xml.signature.Signature would let me validate the digest algorithms, if the references
were cast to a SAMLObjectContentReference, like so:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"> List<ContentReference> contentRefs = signature.getContentReferences();<o:p></o:p></p>
<p class="MsoNormal"> for ( int i = 0 ; i < contentRefs.size() ; i++ ) {<o:p></o:p></p>
<p class="MsoNormal"> ContentReference ref = contentRefs.get(i);<o:p></o:p></p>
<p class="MsoNormal"> String detectedDigestAlgo = "";<o:p></o:p></p>
<p class="MsoNormal">
<o:p></o:p></p>
<p class="MsoNormal"> if ( ref instanceof SAMLObjectContentReference ) {<o:p></o:p></p>
<p class="MsoNormal"> detectedDigestAlgo = ((SAMLObjectContentReference)ref).getDigestAlgorithm();<o:p></o:p></p>
<p class="MsoNormal"> }<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in;text-indent:.5in"> if ( !MessageDigestAlgorithm.ALGO_ID_DIGEST_SHA256.equals(detectedDigestAlgo) )<o:p></o:p></p>
<p class="MsoNormal"> {<o:p></o:p></p>
<p class="MsoNormal"> // do stuff<o:p></o:p></p>
<p class="MsoNormal"> }<o:p></o:p></p>
<p class="MsoNormal"> }<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">While it seems that the content references are initialized (the transforms appear to be correct, the signableObject points to the Assertion, etc), the digestAlgorithm is set to a default value (<a href="http://www.w3.org/2000/09/xmldsig#sha1">http://www.w3.org/2000/09/xmldsig#sha1</a>”,
which is not what is used in the Assertion.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Is there a way to retrieve the actual digest method that was used? I could just parse the original SOAPElement, but if there is an OpenSAML-ish way to go about it that would be helpful.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Thanx,<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><b>Stephen W. Chappell<o:p></o:p></b></p>
</div>
</body>
</html>