<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";
color:black;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
{mso-style-priority:99;
mso-style-link:"Balloon Text Char";
margin:0in;
margin-bottom:.0001pt;
font-size:8.0pt;
font-family:"Tahoma","sans-serif";
color:black;}
span.BalloonTextChar
{mso-style-name:"Balloon Text Char";
mso-style-priority:99;
mso-style-link:"Balloon Text";
font-family:"Tahoma","sans-serif";}
span.EmailStyle19
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:windowtext;}
span.EmailStyle20
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body bgcolor="white" lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="color:windowtext">Well, that’s unfortunate; I’ll have to crack it out of the SOAPElement then. Thanx!<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:windowtext"><o:p> </o:p></span></p>
<div>
<p class="MsoNormal"><b><span style="color:windowtext">Stephen W. Chappell<o:p></o:p></span></b></p>
</div>
<p class="MsoNormal"><span style="color:windowtext"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif";color:windowtext">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif";color:windowtext"> dev-bounces@shibboleth.net [mailto:dev-bounces@shibboleth.net]
<b>On Behalf Of </b>Brent Putman<br>
<b>Sent:</b> Monday, December 29, 2014 4:15 PM<br>
<b>To:</b> dev@shibboleth.net<br>
<b>Subject:</b> Re: Retrieve the digest algorithm(s) used in an Assertion<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">On 12/29/14 2:48 PM, <a href="mailto:Stephen.CTR.Chappell@faa.gov">
Stephen.CTR.Chappell@faa.gov</a> wrote:<o:p></o:p></p>
</div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<p class="MsoNormal">I had thought that iterating over the ContentReference list in the org.opensaml.xml.signature.Signature would let me validate the digest algorithms, if the references were cast to a SAMLObjectContentReference, like so:<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
</blockquote>
<p class="MsoNormal"><span style="font-size:12.0pt;font-family:"Times New Roman","serif""><br>
No, unfortunately not. In both v2 and v3 since most of the signature support is based on Apache Santuario, we don't really fully unmarshall the original DOM Element data to Java objects. The Signature XMLObject impl is kind of the oddball of all our XMLObject
provider impls.<br>
<br>
<br>
<br>
<br>
<o:p></o:p></span></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">While it seems that the content references are initialized (the transforms appear to be correct, the signableObject points to the Assertion, etc), the digestAlgorithm is set to a default value (<a href="http://www.w3.org/2000/09/xmldsig#sha1">http://www.w3.org/2000/09/xmldsig#sha1</a>”,
which is not what is used in the Assertion.<o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:12.0pt;font-family:"Times New Roman","serif""><br>
I actually think in both cases you're just seeing the content reference defaults. The transform ones just happen to be correct for your example data. I don't think we do anything to populate those on unmarshalling, as I said above.<br>
<br>
<br>
<br>
<o:p></o:p></span></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">Is there a way to retrieve the actual digest method that was used? I could just parse the original SOAPElement, but if there is an OpenSAML-ish way to go about it that would be helpful.<o:p></o:p></p>
<p class="MsoNormal" style="margin-bottom:12.0pt"><span style="font-size:12.0pt;font-family:"Times New Roman","serif""><br>
<br>
In v3 we actually have a new similar feature, in that we support an algorithm whitelist/blacklist eval. For that, we just evaluate the Signature DOM Element directly:<br>
<br>
<a href="http://svn.shibboleth.net/view/java-opensaml/trunk/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/support/impl/SignatureAlgorithmValidator.java?revision=3984&view=markup">http://svn.shibboleth.net/view/java-opensaml/trunk/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/support/impl/SignatureAlgorithmValidator.java?revision=3984&view=markup</a><br>
<br>
<o:p></o:p></span></p>
</div>
</body>
</html>