<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<p><br>
</p>
<br>
<div class="moz-cite-prefix">On 10/30/18 8:35 AM, Binh Pham wrote:<br>
</div>
<blockquote type="cite"
cite="mid:CAK903wPA_dohaoBmYqZu1nXXpLw_bOOVWxwsoDtGQV636KD5zg@mail.gmail.com">
<meta http-equiv="content-type" content="text/html; charset=utf-8">
<div dir="ltr">
<div dir="ltr">
<div class="gmail_default" style="font-family:georgia,serif">I
am trying to implement the NHIN SAML specs (<a
href="https://sequoiaproject.org/wp-content/uploads/2014/11/nhin-authorization-framework-production-specification-v3.0.pdf"
moz-do-not-send="true">https://sequoiaproject.org/wp-content/uploads/2014/11/nhin-authorization-framework-production-specification-v3.0.pdf</a>)
which the SAML token will appear in the header of the SOAP
envelope for each request.</div>
</div>
</div>
</blockquote>
<br>
Ok. It's good that you have a concrete spec here.<br>
<br>
<br>
<blockquote type="cite"
cite="mid:CAK903wPA_dohaoBmYqZu1nXXpLw_bOOVWxwsoDtGQV636KD5zg@mail.gmail.com">
<div dir="ltr">
<div dir="ltr">
<div class="gmail_default" style="font-family:georgia,serif">In
this specs, there are two parts to the token which are the
timestamp and an assertion. I need to sign the timestamp and
the assertion. I don't see there is a way to sign the
timestamp with the current version (v3) of the library. </div>
</div>
</div>
</blockquote>
Looks like for the Assertion it does want a standard Enveloped
signature, which is fine and easy.<br>
<br>
In the spec in Figure 3.2-1 and in the text in section 3.1.2, it
illustrates that the Timestamp signature is a (second, separate)
Detached signature, not Enveloped. The Signature element will be a
peer of the Timestamp element, not a child as with Enveloped.<br>
<br>
Virtually anything can be signed with a Detached signature, esp (as
here) if it's in the same document as the signature and carries an
ID attribute. For that case in OpenSAML you use the
DocumentInternalIDContentReference impl of ContentReference, with
the ID value supplied to the constructor being that of the
Timestamp. And then add that to the List<ContentReference> of
the Signature. That's really the only significant difference from
the Enveloped signature cases via SignableXMLObject and
SignableSAMLObject (where the latter adds a
SAMLObjectContentReference automatically).<br>
</body>
</html>