<html>
<head>
<meta http-equiv="Content-Type" content="text/html;
charset=windows-1252">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<p><br>
</p>
<div class="moz-cite-prefix">On 1/5/19 11:49 PM, Eze Ikonne wrote:<br>
</div>
<blockquote type="cite"
cite="mid:PN1PR01MB0750568B7040251F12BD475092880@PN1PR01MB0750.INDPRD01.PROD.OUTLOOK.COM">
<meta http-equiv="Content-Type" content="text/html;
charset=windows-1252">
<meta name="Generator" content="Microsoft Word 15 (filtered
medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
<div class="WordSection1">
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Hi all,<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I am not sure if this the right forum for
the issue that I having,</p>
</div>
</blockquote>
<p><br>
</p>
<p>Yes, this list (the Shibboleth developer's list) is the right
place.<br>
</p>
<p><br>
</p>
<blockquote type="cite"
cite="mid:PN1PR01MB0750568B7040251F12BD475092880@PN1PR01MB0750.INDPRD01.PROD.OUTLOOK.COM">
<div class="WordSection1">
<p class="MsoNormal"> I have upgraded to opensaml3 downloaded
from shibboleth. My application is a service provider and I am
trying to validate Saml Response from an IDP that has a
signed Assertion. <o:p></o:p></p>
<br>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal" style="text-autospace:none"><span
style="font-size:10.0pt;font-family:"Courier
New";color:black">
<span style="background:silver;mso-highlight:silver">BasicX509Credential</span>
cred =
</span><b><span
style="font-size:10.0pt;font-family:"Courier
New";color:#7F0055">new</span></b><span
style="font-size:10.0pt;font-family:"Courier
New";color:black">
<span style="background:silver;mso-highlight:silver">BasicX509Credential</span>();</span><span
style="font-size:10.0pt;font-family:"Courier New""><o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span
style="font-size:10.0pt;font-family:"Courier
New";color:black">
cred.setEntityCertificate(matchedCert);</span><span
style="font-size:10.0pt;font-family:"Courier New""><o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span
style="font-size:10.0pt;font-family:"Courier
New";color:black">
cred.setPublicKey(matchedCert.getPublicKey());</span><span
style="font-size:10.0pt;font-family:"Courier New""><o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span
style="font-size:10.0pt;font-family:"Courier
New";color:black"> cred.setCRLs(</span><b><span
style="font-size:10.0pt;font-family:"Courier
New";color:#7F0055">null</span></b><span
style="font-size:10.0pt;font-family:"Courier
New";color:black">);
</span><span style="font-size:10.0pt;font-family:"Courier
New""><o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span
style="font-size:10.0pt;font-family:"Courier
New";color:black">
</span><span style="font-size:10.0pt;font-family:"Courier
New""><o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span
style="font-size:10.0pt;font-family:"Courier
New";color:black"> </span><b><span
style="font-size:10.0pt;font-family:"Courier
New";color:#7F0055">try</span></b><span
style="font-size:10.0pt;font-family:"Courier
New";color:black"> {</span><span
style="font-size:10.0pt;font-family:"Courier New""><o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span
style="font-size:10.0pt;font-family:"Courier
New";color:black"> SignatureValidator
signatureValidator =
</span><b><span
style="font-size:10.0pt;font-family:"Courier
New";color:#7F0055">new</span></b><span
style="font-size:10.0pt;font-family:"Courier
New";color:black"> SignatureValidator(cred);</span><span
style="font-size:10.0pt;font-family:"Courier New""><o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span
style="font-size:10.0pt;font-family:"Courier
New";color:black">
signatureValidator.validate(sig);</span><span
style="font-size:10.0pt;font-family:"Courier New""><o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span
style="font-size:10.0pt;font-family:"Courier
New";color:black">
</span><b><span
style="font-size:10.0pt;font-family:"Courier
New";color:#7F0055">return</span></b><span
style="font-size:10.0pt;font-family:"Courier
New";color:black">
</span><b><span
style="font-size:10.0pt;font-family:"Courier
New";color:#7F0055">true</span></b><span
style="font-size:10.0pt;font-family:"Courier
New";color:black">;</span><span
style="font-size:10.0pt;font-family:"Courier New""><o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span
style="font-size:10.0pt;font-family:"Courier
New";color:black"> }
</span><b><span
style="font-size:10.0pt;font-family:"Courier
New";color:#7F0055">catch</span></b><span
style="font-size:10.0pt;font-family:"Courier
New";color:black"> (ValidationException ex) {</span><span
style="font-size:10.0pt;font-family:"Courier New""><o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span
style="font-size:10.0pt;font-family:"Courier
New";color:black">
ex.printStackTrace();</span><span
style="font-size:10.0pt;font-family:"Courier New""><o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span
style="font-size:10.0pt;font-family:"Courier
New";color:black"> System.</span><i><span
style="font-size:10.0pt;font-family:"Courier
New";color:#0000C0">out</span></i><span
style="font-size:10.0pt;font-family:"Courier
New";color:black">.println(</span><span
style="font-size:10.0pt;font-family:"Courier
New";color:#2A00FF">"******** signature validation
failed"</span><span
style="font-size:10.0pt;font-family:"Courier
New";color:black">);</span><span
style="font-size:10.0pt;font-family:"Courier New""><o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span
style="font-size:10.0pt;font-family:"Courier
New";color:black"> }</span><span
style="font-size:10.0pt;font-family:"Courier New""><o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span
style="font-size:10.0pt;font-family:"Courier
New";color:black">
</span><span style="font-size:10.0pt;font-family:"Courier
New""><o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</blockquote>
<p><br>
</p>
<p>I don't see anything fundamentally wrong with that code. It
should work, for valid signature and credential inputs.<br>
</p>
<p>(For the record, there are other better ways using higher-level
components to do signature validation for real-world use cases,
using TrustEngine(s) and credentials resolved from SAML metadata.
Those are pretty much mandatory if you have to deal with multiple
SAML peers. But none of that is relevant to your problem.)<br>
</p>
<p><br>
</p>
<blockquote type="cite"
cite="mid:PN1PR01MB0750568B7040251F12BD475092880@PN1PR01MB0750.INDPRD01.PROD.OUTLOOK.COM">
<div class="WordSection1">
<p class="MsoNormal">But I keep getting the following stacktrace
…<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">2019-01-03 21:21:03,857 [Service-0] DEBUG
systemout - org.opensaml.xml.validation.ValidationException:
Signature did not validate against the credential's key<o:p></o:p></p>
<p class="MsoNormal">2019-01-03 21:21:03,858 [Service-0] DEBUG
systemout - at
org.opensaml.xml.signature.SignatureValidator.validate(SignatureValidator.java:78)<o:p></o:p></p>
<p class="MsoNormal">2019-01-03 21:21:03,858 [Service-0] DEBUG
systemout - at
com.sterlingcommerce.component.token.saml.SimpleSamlTokenManager.verifySAMLSignature(SimpleSamlTokenManager.java:482)<o:p></o:p></p>
<p class="MsoNormal">2019-01-03 21:21:03,858 [Service-0] DEBUG
systemout - at
com.sterlingcommerce.component.token.saml.SimpleSamlTokenManager.validateAssertionSignature(SimpleSamlTokenManager.java:370)<o:p></o:p></p>
<p class="MsoNormal">2019-01-03 21:21:03,859 [Service-0] DEBUG
systemout - at
com.sterlingcommerce.component.token.saml.SimpleSamlTokenManager.validateSignature(SimpleSamlTokenManager.java:333)<o:p></o:p></p>
<p class="MsoNormal">2019-01-03 21:21:03,859 [Service-0] DEBUG
systemout - at
com.sterlingcommerce.component.token.saml.SimpleSamlTokenManager.verifySamlAuthenticationResponse(SimpleSamlTokenManager.java:300)<o:p></o:p></p>
<p class="MsoNormal">2019-01-03 21:21:03,859 [Service-0] DEBUG
systemout - at
com.sterlingcommerce.component.sso.impl.SingleSignonServiceImpl.samlTokenVerify(SingleSignonServiceImpl.java:749)<o:p></o:p></p>
<p class="MsoNormal">2019-01-03 21:21:03,859 [Service-0] DEBUG
systemout - at
com.sterlingcommerce.component.sso.impl.SingleSignonServiceImpl$RequestListener$8.run(SingleSignonServiceImpl.java:1790)<o:p></o:p></p>
<p class="MsoNormal">2019-01-03 21:21:03,860 [Service-0] DEBUG
systemout - at
EDU.oswego.cs.dl.util.concurrent.PooledExecutor$Worker.run(PooledExecutor.java:727)<o:p></o:p></p>
<p class="MsoNormal">2019-01-03 21:21:03,860 [Service-0] DEBUG
systemout - at
java.lang.Thread.run(Thread.java:811)<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I would appreciate it if anyone could point
me to the right solution or maybe point out what my code is
doing wrong. I have tried to run sample codes around this
issue, but I have still to get any of the signature validation
to be successful. Any help or suggestions would be greatly
appreciated.<o:p></o:p></p>
</div>
<br>
</blockquote>
<p><br>
</p>
<p>Your code itself isn't wrong. So the most likely explanations
are: 1) the certificate/public key with which you're trying to
validate is not the correct one 2) you're corrupting the XML you
receive before validating it 3) the signer (IdP) has a bug and is
generating an invalid signature. Unless the IdP is somebody's
one-off and isn't a known good XML signature implementation, given
our past experience #1 is far and away the most likely issue (like
90%+ probability). If you've already double-checked it, then
triple- and quadruple-check it. Most people swear that is not the
problem, up to the moment they figure out that it is...</p>
<p>You may find this page in our wiki helpful. It's still homed in
the OpenSAML v2 section, but ignore the warning about the old
version. All the info there is still relevant to v3.</p>
<p><a class="moz-txt-link-freetext" href="https://wiki.shibboleth.net/confluence/display/OpenSAML/OSTwoUserManSigErrors">https://wiki.shibboleth.net/confluence/display/OpenSAML/OSTwoUserManSigErrors</a></p>
<p><br>
</p>
<p>Thanks,<br>
Brent<br>
</p>
<p><br>
</p>
</body>
</html>