<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<p><br>
</p>
<div class="moz-cite-prefix">On 4/24/20 6:35 AM, Paul Statham wrote:<br>
</div>
<blockquote type="cite"
cite="mid:CAC0wpi9ZzW9UX7n3ia6J3AuNhN0ofvA1f+eiJ1E-kjt08Anaiw@mail.gmail.com">
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
<div dir="ltr">Hi,
<div><br>
</div>
<div>I have created a simple SOAP service which will accept an
AttributeQuery SAML element in the body of a SOAP envelope.
This works fine, I am now moving on to validating a signed
AttributeQuery. To do this I have created a simple integration
test to build an attribute query, sign it and use a soap
client to send the request.</div>
<div><br>
</div>
<div>The signing is done like so</div>
</div>
</blockquote>
<p><br>
</p>
<p>I don't see any issues with signing and validation code itself.<br>
</p>
<p><br>
</p>
<blockquote type="cite"
cite="mid:CAC0wpi9ZzW9UX7n3ia6J3AuNhN0ofvA1f+eiJ1E-kjt08Anaiw@mail.gmail.com">
<div dir="ltr"><br>
<div><br>
</div>
<div>The validation is failing, it seems that the decoded digest
value is different from the computed digest value, and I can't
for the life of me see why. Any ideas? Here's a sample soap
envelope sent as a request.</div>
</div>
<br>
</blockquote>
<p><br>
</p>
<p>That error pretty much means what it says. The bytes that you
are validating are not the same bytes that were signed. Something
is changing the document between signing and validation, for
example how you are serializing and then deserializing/parsing
it. For example, pretty printing or adding/removing a single
whitespace character will invalidate the signature.<br>
</p>
<p>We have some signature troubleshooting docs here (it's the v2
wiki space, but the info is the same for 3 and 4):</p>
<p><a class="moz-txt-link-freetext" href="https://wiki.shibboleth.net/confluence/display/OpenSAML/OSTwoUserManSigErrors">https://wiki.shibboleth.net/confluence/display/OpenSAML/OSTwoUserManSigErrors</a></p>
<p>Pay attention to #3, but especially #5. That gives you the
details on how to get logging on what you have signed vs what you
are validating. Figure out the delta(s) between them and then go
from there.<br>
</p>
<p><br>
</p>
</body>
</html>