<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";
color:black;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal;
font-family:"Tahoma","sans-serif";
font-variant:normal !important;
color:windowtext;
text-transform:none;
text-decoration:none none;
vertical-align:baseline;}
span.EmailStyle18
{mso-style-type:personal;
font-family:"Tahoma","sans-serif";
font-variant:normal !important;
color:black;
text-transform:none;
font-weight:normal;
font-style:normal;
text-decoration:none none;
vertical-align:baseline;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Tahoma","sans-serif";
font-variant:normal !important;
color:black;
text-transform:none;
font-weight:normal;
font-style:normal;
text-decoration:none none;
vertical-align:baseline;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body bgcolor="white" lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif";color:black">Brent – yes, that was it. When I’d copy/pasted the XML the tabs/indentation ended up slightly different. We’d assumed that the formatting (tabs, carriage returns,
etc) of the XML wasn’t important. After all, the signature is being checked against a Document object hierarchy rather than the String representation, and it’s not an unreasonable assumption that none of the formatting gets carried over into the object representation.
But it seems this does make a difference. Once I’d corrected it, it happily validated. Really appreciate your assistance! Thanks, Richard<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif";color:black"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif";color:black"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif";color:windowtext">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif";color:windowtext"> dev [mailto:dev-bounces@shibboleth.net]
<b>On Behalf Of </b>Brent Putman<br>
<b>Sent:</b> 03 June 2015 20:00<br>
<b>To:</b> dev@shibboleth.net<br>
<b>Subject:</b> Re: Can you help me successfully validate the signature of an assertion?<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal" style="margin-bottom:12.0pt"><o:p> </o:p></p>
<div>
<p class="MsoNormal">On 6/3/15 11:28 AM, Richard Mundell wrote:<o:p></o:p></p>
</div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> </span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">The code is here:
<a href="http://pastebin.com/vkNVGEXW">http://pastebin.com/vkNVGEXW</a> </span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> </span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">2) unmarshalls the assertion response from a String into an OpenSAML Assertion object</span><o:p></o:p></p>
</blockquote>
<p class="MsoNormal"><span style="font-size:12.0pt;font-family:"Times New Roman","serif""><br>
The Assertion string you have there looks suspciously indented/pretty-printed... I don't think TestShib generates Assertions formatted like that. And since you're pulling it in as a string, and having to escape things, etc, almost certainly there's some error
in there, such that it's not the same XML that was signed.<br>
<br>
<br>
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> </span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">Unfortunately this final step doesn't work and I get a “Invalid signature due to this error: Signature did not validate against the credential's key” exception.</span><o:p></o:p></p>
<p class="MsoNormal" style="margin-bottom:12.0pt"><span style="font-size:12.0pt;font-family:"Times New Roman","serif""><br>
Assuming you're sure you have the right validation key, I'd wager with 99.9% certainty that you have corrupted the Assertion by modifying it from what was signed. Adding/removing even a single character of whitespace will invalidate the signature.<br>
<br>
In case you haven't found yet:<br>
<br>
<a href="https://wiki.shibboleth.net/confluence/display/OpenSAML/OSTwoUserManJavaDSIG">https://wiki.shibboleth.net/confluence/display/OpenSAML/OSTwoUserManJavaDSIG</a><br>
<br>
and in particular:<br>
<br>
<a href="https://wiki.shibboleth.net/confluence/display/OpenSAML/OSTwoUserManSigErrors">https://wiki.shibboleth.net/confluence/display/OpenSAML/OSTwoUserManSigErrors</a><br>
<br>
<o:p></o:p></span></p>
</div>
</body>
</html>