<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<p><br>
</p>
<br>
<div class="moz-cite-prefix">On 9/7/16 8:25 AM, Lasse Højgaard
wrote:<br>
</div>
<blockquote
cite="mid:HE1PR01MB190096EEE079DDB1A65D0069B6F80@HE1PR01MB1900.eurprd01.prod.exchangelabs.com"
type="cite">
<pre wrap="">Hi list,
My system is acting as the SP in this case.
I'm trying to validate the signature of incoming assertions, with the public key from the IdP's metadata.
</pre>
</blockquote>
<br>
I don't see anything obviously wrong with the metadata and code you
posted. But it's possible I'm missing something.<br>
<br>
<blockquote
cite="mid:HE1PR01MB190096EEE079DDB1A65D0069B6F80@HE1PR01MB1900.eurprd01.prod.exchangelabs.com"
type="cite">
<pre wrap="">
The error seems to be in the actual byte comparison for the RSA-SHA1 algorithm.</pre>
</blockquote>
<br>
<br>
If you haven't already done so, I'd start with getting a full DEBUG
log trace from OpenSAML of the whole operation. That will confirm
precisely where it's failing: the actual cryptographic validation of
the signature, vs. the trust eval of the signing key, vs something
else.<br>
<br>
If it really turns out to be that the signature won't validate,
you'd want to compare the bytes of what the IdP is actually signing
with what the SP is verifying. This info is still relevant, even
though it's in OpenSAML 2 wiki:<br>
<br>
<a class="moz-txt-link-freetext" href="https://wiki.shibboleth.net/confluence/display/OpenSAML/OSTwoUserManSigErrors">https://wiki.shibboleth.net/confluence/display/OpenSAML/OSTwoUserManSigErrors</a><br>
<br>
In particular section 5, on how to get DEBUG log from Apache
Santuario of the bytes to be digested. You didn't say what the IdP
is, so you may or may not be able to get the similar log data from
that side.<br>
<br>
<blockquote
cite="mid:HE1PR01MB190096EEE079DDB1A65D0069B6F80@HE1PR01MB1900.eurprd01.prod.exchangelabs.com"
type="cite">
<pre wrap="">
However! I was able to successfully validate the assertion using the online tool: <a class="moz-txt-link-freetext" href="https://www.samltool.com/validate_response.php">https://www.samltool.com/validate_response.php</a> </pre>
</blockquote>
<br>
If the response/assertion signature validates there, then that
actually is a good indication that in fact there is a problem in
your code somewhere. Maybe it's something subtle with the metadata
or entityID, or with how you're setting up the trust engine.
Getting some DEBUG logging would help diagnose that.<br>
<br>
</body>
</html>