<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<p><br>
</p>
<br>
<div class="moz-cite-prefix">On 10/30/18 9:11 PM, Binh Pham wrote:<br>
</div>
<blockquote type="cite"
cite="mid:CAK903wNsvmGW98c=Jsex0tOLVJwdcNCHMi_sq0DqTbeaeRYVzw@mail.gmail.com">
<meta http-equiv="content-type" content="text/html; charset=utf-8">
<div dir="ltr">
<div dir="ltr">
<div dir="ltr">
<div dir="ltr">
<div class="gmail_default"
style="font-family:georgia,serif">It throws the
exception "Unable to compute signature, Signature
XMLObject does not have the XMLSignature created during
marshalling." when I call Signer.signObject(signature);</div>
</div>
</div>
</div>
</div>
</blockquote>
<br>
Like all the XML signing in OpenSAML, you have to marshall the
object(s) first. That's because the signing is done at the DOM
level by the Apache Santuario library that we use for XML signing
(and encryption).<br>
<br>
<br>
<br>
<blockquote type="cite"
cite="mid:CAK903wNsvmGW98c=Jsex0tOLVJwdcNCHMi_sq0DqTbeaeRYVzw@mail.gmail.com">
<div dir="ltr">
<div dir="ltr">
<div dir="ltr">
<div dir="ltr">
<div class="gmail_default"
style="font-family:georgia,serif">So the Timestamp will
be a child of Security.</div>
</div>
</div>
</div>
</div>
</blockquote>
<br>
Yes, but...<br>
<br>
<blockquote type="cite"
cite="mid:CAK903wNsvmGW98c=Jsex0tOLVJwdcNCHMi_sq0DqTbeaeRYVzw@mail.gmail.com">
<div dir="ltr">
<div dir="ltr">
<div dir="ltr">
<div dir="ltr">
<div class="gmail_default"
style="font-family:georgia,serif"> The Security is not
a SignableXMLObject. </div>
</div>
</div>
</div>
</div>
</blockquote>
<br>
True, but completely irrelevant. The SignableXMLObject and
SignableSAMLObject are only applicable for Enveloped signature
cases. They are not relevant for Detached and Enveloping cases.<br>
<br>
<br>
<blockquote type="cite"
cite="mid:CAK903wNsvmGW98c=Jsex0tOLVJwdcNCHMi_sq0DqTbeaeRYVzw@mail.gmail.com">
<div dir="ltr">
<div dir="ltr">
<div dir="ltr">
<div dir="ltr">
<div class="gmail_default"
style="font-family:georgia,serif">I am wondering if I
have to create a SignableXMLObject class and add
Timestamp as a child and try to sign from there. <br>
</div>
</div>
</div>
</div>
</div>
</blockquote>
<br>
<br>
No, absolutely not. Just be sure to marshall the Signature and
Timestamp objects before you call Signer.signObject.<br>
<br>
When you get around to doing the Assertion signature, same thing,
you must marshall the Assertion before Signer.signObject.<br>
</body>
</html>