<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<p><br>
</p>
<br>
<div class="moz-cite-prefix">On 10/29/18 4:47 PM, Binh Pham wrote:<br>
</div>
<blockquote type="cite"
cite="mid:CAK903wPF10GuVP7u-g8VXDUm3g-2MAoQnHq1OSanAygFaVXUOw@mail.gmail.com">
<meta http-equiv="content-type" content="text/html; charset=utf-8">
<div dir="ltr">
<div dir="ltr">
<div class="gmail_default" style="font-family:georgia,serif"><br>
</div>
<div class="gmail_default" style="font-family:georgia,serif"><br>
</div>
<div class="gmail_default" style="font-family:georgia,serif">I
need to sign the timestamp and assertion in the SAML token
using OpenSAML v3. </div>
</div>
</div>
</blockquote>
<br>
Sounds like your use case is WS-Security and possibly other WS-*
friends?<br>
<br>
<blockquote type="cite"
cite="mid:CAK903wPF10GuVP7u-g8VXDUm3g-2MAoQnHq1OSanAygFaVXUOw@mail.gmail.com">
<div dir="ltr">
<div dir="ltr">
<div class="gmail_default" style="font-family:georgia,serif">The
assertion inherits from SignableSAMLObject so I can attach a
signature object to sign.</div>
</div>
</div>
</blockquote>
<br>
Yes, but that is specifically for Enveloped signature, not all
possible XML signature use cases (e.g. Detached or Enveloping).
Enveloped is the common use case for Assertions in SAML profiles
(SSO, etc), but with WS-* I have no idea about what you are trying
to do.<br>
<br>
<blockquote type="cite"
cite="mid:CAK903wPF10GuVP7u-g8VXDUm3g-2MAoQnHq1OSanAygFaVXUOw@mail.gmail.com">
<div dir="ltr">
<div dir="ltr">
<div class="gmail_default" style="font-family:georgia,serif">
Timestamp, however is not. </div>
</div>
</div>
</blockquote>
<br>
Correct. It typically would not have an Enveloped signature,
doesn't make much sense. In fact it may be literally impossible,
based on the schema.<br>
<br>
<blockquote type="cite"
cite="mid:CAK903wPF10GuVP7u-g8VXDUm3g-2MAoQnHq1OSanAygFaVXUOw@mail.gmail.com">
<div dir="ltr">
<div dir="ltr">
<div class="gmail_default" style="font-family:georgia,serif">How
do I sign Timestamp for this case before attach the security
element to the SOAP header?</div>
</div>
</div>
</blockquote>
<br>
WS-Security and the other WS-* specs are not really implementable by
themselves. They are more building blocks with which to assemble
profiles that can then be implemented. So you really will have to
be much more specific in what you are trying to do.<br>
<br>
Ideally you are implementing an existing SOAP profile that is
concretely well-defined ... (pauses for laughter) ... but if not,
then you at the very least need to know *exactly* what you are
trying to do. The OpenSAML library will not hold your hand much in
this, unfortunately. The SOAP support is pretty low-level.<br>
<br>
There are multiple possible variants, such as whether the Assertion
is signed or not with an Enveloped signature (so that it is
effectively usable as a standalone security token - which if so also
leads to a myriad of issues with subject confirmation, conditions,
etc.), and then what the WS-Security signature will "cover" -
presumably it will be a Detached one over the Assertion and the
Timestamp and possibly other things. But basically it all boils
down to what you specify as the signature's content reference(s).<br>
<br>
<br>
</body>
</html>