<div dir="ltr">I'm migrating my code base from OpenSAML 2 to 3 and have encountered an issue with the signatures being generated. I'm generating the below SAML response:<div><br></div><div><div><saml2p:Response xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol"</div><div> xmlns:xsd="<a href="http://www.w3.org/2001/XMLSchema">http://www.w3.org/2001/XMLSchema</a>"</div><div> Destination="<a href="http://shib2x.tremolo.lan/Shibboleth.sso/SAML2/POST">http://shib2x.tremolo.lan/Shibboleth.sso/SAML2/POST</a>"</div><div> ID="fd2e829e77881b351b490d9dc19cff85a27f7a8ea"</div><div> IssueInstant="2017-01-03T17:26:51.255Z"</div><div> Version="2.0"</div><div> ></div><div><span class="gmail-Apple-tab-span" style="white-space:pre"> </span><saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"><a href="http://localhost.localdomain:6060/auth/idp/saml2">http://localhost.localdomain:6060/auth/idp/saml2</a></saml2:Issuer></div><div><span class="gmail-Apple-tab-span" style="white-space:pre"> </span><ds:Signature xmlns:ds="<a href="http://www.w3.org/2000/09/xmldsig#">http://www.w3.org/2000/09/xmldsig#</a>"></div><div><span class="gmail-Apple-tab-span" style="white-space:pre"> </span><ds:SignedInfo></div><div><span class="gmail-Apple-tab-span" style="white-space:pre"> </span><ds:CanonicalizationMethod Algorithm="<a href="http://www.w3.org/2001/10/xml-exc-c14n#">http://www.w3.org/2001/10/xml-exc-c14n#</a>" /></div><div><span class="gmail-Apple-tab-span" style="white-space:pre"> </span><ds:SignatureMethod Algorithm="<a href="http://www.w3.org/2000/09/xmldsig#rsa-sha1">http://www.w3.org/2000/09/xmldsig#rsa-sha1</a>" /></div><div><span class="gmail-Apple-tab-span" style="white-space:pre"> </span><ds:Reference URI="#fd2e829e77881b351b490d9dc19cff85a27f7a8ea"></div><div><span class="gmail-Apple-tab-span" style="white-space:pre"> </span><ds:Transforms></div><div><span class="gmail-Apple-tab-span" style="white-space:pre"> </span><ds:Transform Algorithm="<a href="http://www.w3.org/2000/09/xmldsig#enveloped-signature">http://www.w3.org/2000/09/xmldsig#enveloped-signature</a>" /></div><div><span class="gmail-Apple-tab-span" style="white-space:pre"> </span><ds:Transform Algorithm="<a href="http://www.w3.org/2001/10/xml-exc-c14n#">http://www.w3.org/2001/10/xml-exc-c14n#</a>"></div><div><span class="gmail-Apple-tab-span" style="white-space:pre"> </span><ec:InclusiveNamespaces xmlns:ec="<a href="http://www.w3.org/2001/10/xml-exc-c14n#">http://www.w3.org/2001/10/xml-exc-c14n#</a>"</div><div><span class="gmail-Apple-tab-span" style="white-space:pre"> </span> PrefixList="xsd"</div><div><span class="gmail-Apple-tab-span" style="white-space:pre"> </span> /></div><div><span class="gmail-Apple-tab-span" style="white-space:pre"> </span></ds:Transform></div><div><span class="gmail-Apple-tab-span" style="white-space:pre"> </span></ds:Transforms></div><div><span class="gmail-Apple-tab-span" style="white-space:pre"> </span><ds:DigestMethod Algorithm="<a href="http://www.w3.org/2001/04/xmlenc#sha256">http://www.w3.org/2001/04/xmlenc#sha256</a>" /></div><div><span class="gmail-Apple-tab-span" style="white-space:pre"> </span><ds:DigestValue>ubwqWUjtEDYwRTJjadkpbqqyp36qStUdqKXNyNjSrXg=</ds:DigestValue></div><div><span class="gmail-Apple-tab-span" style="white-space:pre"> </span></ds:Reference></div><div><span class="gmail-Apple-tab-span" style="white-space:pre"> </span></ds:SignedInfo></div><div><span class="gmail-Apple-tab-span" style="white-space:pre"> </span><ds:SignatureValue></div><div>fFXh1Xh4sFVjtuc3jidXJsQ4+HcMp9km8bHSrvAz6ZUoLaH49Hnv0aPosagxSdja0//XgJRSf6x3</div><div>v0t67n4/KLSFDyULJbe4rFjEFtxQL8AAtuUEghQd3Hfwg4+a1Pl6TKlrNVVi0g1l9EcA2QsrCx0R</div><div>HrleGjAO7e/zvK5tsg8=</div><div></ds:SignatureValue></div><div><span class="gmail-Apple-tab-span" style="white-space:pre"> </span></ds:Signature></div><div><span class="gmail-Apple-tab-span" style="white-space:pre"> </span><saml2p:Status></div><div><span class="gmail-Apple-tab-span" style="white-space:pre"> </span><saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" /></div><div><span class="gmail-Apple-tab-span" style="white-space:pre"> </span></saml2p:Status></div><div><span class="gmail-Apple-tab-span" style="white-space:pre"> </span><saml2:Assertion xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"</div><div><span class="gmail-Apple-tab-span" style="white-space:pre"> </span> ID="fb777d662ef7f844d59a86196cf76b9a85c606eac"</div><div><span class="gmail-Apple-tab-span" style="white-space:pre"> </span> IssueInstant="2017-01-03T17:26:51.255Z"</div><div><span class="gmail-Apple-tab-span" style="white-space:pre"> </span> Version="2.0"</div><div><span class="gmail-Apple-tab-span" style="white-space:pre"> </span> ></div><div><span class="gmail-Apple-tab-span" style="white-space:pre"> </span><saml2:Issuer><a href="http://localhost.localdomain:6060/auth/idp/saml2">http://localhost.localdomain:6060/auth/idp/saml2</a></saml2:Issuer></div><div><span class="gmail-Apple-tab-span" style="white-space:pre"> </span><saml2:Subject></div><div><span class="gmail-Apple-tab-span" style="white-space:pre"> </span><saml2:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified">testsaml2</saml2:NameID></div><div><span class="gmail-Apple-tab-span" style="white-space:pre"> </span><saml2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"></div><div><span class="gmail-Apple-tab-span" style="white-space:pre"> </span><saml2:SubjectConfirmationData NotOnOrAfter="2017-01-03T17:31:51.254Z"</div><div><span class="gmail-Apple-tab-span" style="white-space:pre"> </span> Recipient="<a href="http://shib2x.tremolo.lan/Shibboleth.sso/SAML2/POST">http://shib2x.tremolo.lan/Shibboleth.sso/SAML2/POST</a>"</div><div><span class="gmail-Apple-tab-span" style="white-space:pre"> </span> /></div><div><span class="gmail-Apple-tab-span" style="white-space:pre"> </span></saml2:SubjectConfirmation></div><div><span class="gmail-Apple-tab-span" style="white-space:pre"> </span></saml2:Subject></div><div><span class="gmail-Apple-tab-span" style="white-space:pre"> </span><saml2:Conditions NotBefore="2017-01-03T17:21:51.254Z"</div><div><span class="gmail-Apple-tab-span" style="white-space:pre"> </span> NotOnOrAfter="2017-01-03T17:31:51.254Z"</div><div><span class="gmail-Apple-tab-span" style="white-space:pre"> </span> ></div><div><span class="gmail-Apple-tab-span" style="white-space:pre"> </span><saml2:AudienceRestriction></div><div><span class="gmail-Apple-tab-span" style="white-space:pre"> </span><saml2:Audience><a href="http://shib2x.tremolo.lan/shibboleth">http://shib2x.tremolo.lan/shibboleth</a></saml2:Audience></div><div><span class="gmail-Apple-tab-span" style="white-space:pre"> </span></saml2:AudienceRestriction></div><div><span class="gmail-Apple-tab-span" style="white-space:pre"> </span></saml2:Conditions></div><div><span class="gmail-Apple-tab-span" style="white-space:pre"> </span><saml2:AuthnStatement AuthnInstant="2017-01-03T17:26:51.255Z"</div><div><span class="gmail-Apple-tab-span" style="white-space:pre"> </span> SessionIndex="fb777d662ef7f844d59a86196cf76b9a85c606eac"</div><div><span class="gmail-Apple-tab-span" style="white-space:pre"> </span> ></div><div><span class="gmail-Apple-tab-span" style="white-space:pre"> </span><saml2:AuthnContext></div><div><span class="gmail-Apple-tab-span" style="white-space:pre"> </span><saml2:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml2:AuthnContextClassRef></div><div><span class="gmail-Apple-tab-span" style="white-space:pre"> </span></saml2:AuthnContext></div><div><span class="gmail-Apple-tab-span" style="white-space:pre"> </span></saml2:AuthnStatement></div><div><span class="gmail-Apple-tab-span" style="white-space:pre"> </span><saml2:AttributeStatement></div><div><span class="gmail-Apple-tab-span" style="white-space:pre"> </span><saml2:Attribute Name="groupName"></div><div><span class="gmail-Apple-tab-span" style="white-space:pre"> </span><saml2:AttributeValue xmlns:xsi="<a href="http://www.w3.org/2001/XMLSchema-instance">http://www.w3.org/2001/XMLSchema-instance</a>"</div><div><span class="gmail-Apple-tab-span" style="white-space:pre"> </span> xsi:type="xsd:string"</div><div><span class="gmail-Apple-tab-span" style="white-space:pre"> </span> >testUsers</saml2:AttributeValue></div><div><span class="gmail-Apple-tab-span" style="white-space:pre"> </span></saml2:Attribute></div><div><span class="gmail-Apple-tab-span" style="white-space:pre"> </span><saml2:Attribute Name="role"></div><div><span class="gmail-Apple-tab-span" style="white-space:pre"> </span><saml2:AttributeValue xmlns:xsi="<a href="http://www.w3.org/2001/XMLSchema-instance">http://www.w3.org/2001/XMLSchema-instance</a>"</div><div><span class="gmail-Apple-tab-span" style="white-space:pre"> </span> xsi:type="xsd:string"</div><div><span class="gmail-Apple-tab-span" style="white-space:pre"> </span> >users</saml2:AttributeValue></div><div><span class="gmail-Apple-tab-span" style="white-space:pre"> </span></saml2:Attribute></div><div><span class="gmail-Apple-tab-span" style="white-space:pre"> </span><saml2:Attribute Name="l"></div><div><span class="gmail-Apple-tab-span" style="white-space:pre"> </span><saml2:AttributeValue xmlns:xsi="<a href="http://www.w3.org/2001/XMLSchema-instance">http://www.w3.org/2001/XMLSchema-instance</a>"</div><div><span class="gmail-Apple-tab-span" style="white-space:pre"> </span> xsi:type="xsd:string"</div><div><span class="gmail-Apple-tab-span" style="white-space:pre"> </span> >Boston</saml2:AttributeValue></div><div><span class="gmail-Apple-tab-span" style="white-space:pre"> </span></saml2:Attribute></div><div><span class="gmail-Apple-tab-span" style="white-space:pre"> </span></saml2:AttributeStatement></div><div><span class="gmail-Apple-tab-span" style="white-space:pre"> </span></saml2:Assertion></div><div></saml2p:Response></div></div><div><br></div><div>but everything i test against fails (Shib, OpenAM, ADFS). I tried validating it at <a href="http://samltool.com">samltool.com</a> but I get the error "Reference validation failed". The only issue I see in the reference section is its generating a sha256 digest rather then a sha1 digest the way my 2.x code did. Here's the code I used to generate the signature:</div><div><br></div><div>
<p class="gmail-p1">BasicX509Credential <span class="gmail-s1">signingCredential</span> = CredentialSupport.getSimpleCredential(<span class="gmail-s2">this</span>.<span class="gmail-s3">sigCert</span>, <span class="gmail-s2">this</span>.<span class="gmail-s3">sigKey</span>);</p>
<p class="gmail-p2"><span class="gmail-Apple-tab-span"> </span><span class="gmail-Apple-tab-span"> </span><span class="gmail-Apple-tab-span"> </span></p>
<p class="gmail-p1"><span class="gmail-Apple-tab-span"> </span><span class="gmail-Apple-tab-span"> </span><span class="gmail-Apple-tab-span"> </span>Signature <span class="gmail-s1">signature</span> = OpenSAMLUtils.buildSAMLObject(Signature.<span class="gmail-s2">class</span>);</p>
<p class="gmail-p2"><span class="gmail-Apple-tab-span"> </span><span class="gmail-Apple-tab-span"> </span><span class="gmail-Apple-tab-span"> </span></p>
<p class="gmail-p3"><span class="gmail-s4"><span class="gmail-Apple-tab-span"> </span><span class="gmail-Apple-tab-span"> </span><span class="gmail-Apple-tab-span"> </span></span>//SecurityHelper.prepareSignatureParams(signature, signingCredential, null, null);</p>
<p class="gmail-p2"><span class="gmail-Apple-tab-span"> </span><span class="gmail-Apple-tab-span"> </span><span class="gmail-Apple-tab-span"> </span></p>
<p class="gmail-p2"><span class="gmail-Apple-tab-span"> </span><span class="gmail-Apple-tab-span"> </span><span class="gmail-Apple-tab-span"> </span></p>
<p class="gmail-p1"><span class="gmail-Apple-tab-span"> </span><span class="gmail-Apple-tab-span"> </span><span class="gmail-Apple-tab-span"> </span><span class="gmail-s1">signature</span>.setSigningCredential(<span class="gmail-s1">signingCredential</span>);</p>
<p class="gmail-p1"><span class="gmail-Apple-tab-span"> </span><span class="gmail-Apple-tab-span"> </span><span class="gmail-Apple-tab-span"> </span><span class="gmail-s1">signature</span>.setSignatureAlgorithm(SignatureConstants.<span class="gmail-s3">ALGO_ID_SIGNATURE_RSA_SHA1</span>);</p>
<p class="gmail-p1"><span class="gmail-Apple-tab-span"> </span><span class="gmail-Apple-tab-span"> </span><span class="gmail-Apple-tab-span"> </span><span class="gmail-s1">signature</span>.setCanonicalizationAlgorithm(SignatureConstants.<span class="gmail-s3">ALGO_ID_C14N_EXCL_OMIT_COMMENTS</span>);</p>
<p class="gmail-p2"><span class="gmail-Apple-tab-span"> </span><span class="gmail-Apple-tab-span"> </span><span class="gmail-Apple-tab-span"> </span></p>
<p class="gmail-p1"><span class="gmail-Apple-tab-span"> </span><span class="gmail-Apple-tab-span"> </span><span class="gmail-Apple-tab-span"> </span><span class="gmail-s1">r</span>.setSignature(<span class="gmail-s1">signature</span>); </p>
<p class="gmail-p3"><span class="gmail-s4"><span class="gmail-Apple-tab-span"> </span><span class="gmail-Apple-tab-span"> </span><span class="gmail-Apple-tab-span"> </span></span>//Element e = Configuration.getMarshallerFactory().getMarshaller(r).<span class="gmail-s5">marshall</span>(r); </p>
<p class="gmail-p2"><span class="gmail-Apple-tab-span"> </span><span class="gmail-Apple-tab-span"> </span><span class="gmail-Apple-tab-span"> </span></p>
<p class="gmail-p1"><span class="gmail-Apple-tab-span"> </span><span class="gmail-Apple-tab-span"> </span><span class="gmail-Apple-tab-span"> </span><span class="gmail-s2">try</span> {</p>
<p class="gmail-p1"><span class="gmail-Apple-tab-span"> </span> XMLObjectProviderRegistrySupport.getMarshallerFactory().getMarshaller(<span class="gmail-s1">r</span>).marshall(<span class="gmail-s1">r</span>);</p>
<p class="gmail-p1"><span class="gmail-Apple-tab-span"> </span> } <span class="gmail-s2">catch</span> (MarshallingException <span class="gmail-s1">e</span>) {</p>
<p class="gmail-p1"><span class="gmail-Apple-tab-span"> </span> <span class="gmail-s2">throw</span> <span class="gmail-s2">new</span> RuntimeException(<span class="gmail-s1">e</span>);</p>
<p class="gmail-p1"><span class="gmail-Apple-tab-span"> </span> }</p>
<p class="gmail-p2"><span class="gmail-Apple-tab-span"> </span><span class="gmail-Apple-tab-span"> </span><span class="gmail-Apple-tab-span"> </span></p>
<p class="gmail-p1"><span class="gmail-Apple-tab-span"> </span><span class="gmail-Apple-tab-span"> </span><span class="gmail-Apple-tab-span"> </span>Signer.signObject(<span class="gmail-s1">signature</span>); </p><p class="gmail-p1"><br></p><p class="gmail-p1">I got the code out of "<strong style="color:rgb(51,51,51);font-family:arial,sans-serif;font-size:14px;background-color:rgb(248,247,239)"><a href="https://gumroad.com/l/ypPk" class="external-link" rel="nofollow" style="color:rgb(50,96,186)">A Guide to OpenSAML V3</a>"</strong></p><p class="gmail-p1"><br></p><p class="gmail-p1">Thoughts?</p><p class="gmail-p1">Thanks</p></div></div>