InlineX509DataProvider skips credential extraction if only X509SKI is present

[Andreas Hartmann]

Hi everyone,

were're receiving a SAML response containing a signature with the 
following KeyInfo. IIUC the spec [1] correctly, this should be valid.

         <ds:KeyInfo>
             <ds:X509Data>
                 <ds:X509SKI>
                     ....
                 </ds:X509SKI>
             </ds:X509Data>
         </ds:KeyInfo>

The signature validation fails. Apparently the InlineX509DataProvider 
skips processing because it doesn't find any X509Certificate elements. 
The subject key identifier doesn't seem to be sufficient to denote the key.

         List<X509Certificate> certs = extractCertificates(x509Data);
         if (certs.isEmpty()) {
             log.info("The X509Data contained no X509Certificate 
elements, skipping credential extraction");
             return null;
         }

Is this behaviour desired? Can we do anything to make the signature 
validation work? Or should I look somewhere else for the source of the 
problem?

TIA for any hints!

Here's a snippet from the logs:

DEBUG BaseSignatureTrustEngine - Attempting to verify signature and 
establish trust using KeyInfo-derived credentials
DEBUG BasicProviderKeyInfoCredentialResolver - Found 0 key names: []
DEBUG BasicProviderKeyInfoCredentialResolver - Processing KeyInfo child 
with qname: {http://www.w3.org/2000/09/xmldsig#}X509Data
DEBUG BasicProviderKeyInfoCredentialResolver - Provider 
org.opensaml.xml.security.keyinfo.provider.RSAKeyValueProvider doesn't 
handle objects of type {http://www.w3.org/2000/09/xmldsig#}X509Data, 
skipping
DEBUG BasicProviderKeyInfoCredentialResolver - Provider 
org.opensaml.xml.security.keyinfo.provider.DSAKeyValueProvider doesn't 
handle objects of type {http://www.w3.org/2000/09/xmldsig#}X509Data, 
skipping
DEBUG BasicProviderKeyInfoCredentialResolver - Processing KeyInfo child 
{http://www.w3.org/2000/09/xmldsig#}X509Data with provider 
org.opensaml.xml.security.keyinfo.provider.InlineX509DataProvider
DEBUG InlineX509DataProvider - Attempting to extract credential from an 
X509Data
DEBUG InlineX509DataProvider - Found 0 X509Certificates
INFO  InlineX509DataProvider - The X509Data contained no X509Certificate 
elements, skipping credential extraction
WARN  BasicProviderKeyInfoCredentialResolver - No credentials could be 
extracted from KeyInfo child with qname 
{http://www.w3.org/2000/09/xmldsig#}X509Data by any registered provider
DEBUG BasicProviderKeyInfoCredentialResolver - No credentials were 
found, calling empty credentials post-processing hook
DEBUG BasicProviderKeyInfoCredentialResolver - A total of 0 credentials 
were resolved
DEBUG EvaluableCredentialCriteriaRegistry - Registry could not locate 
evaluable criteria for criteria class 
org.opensaml.xml.security.keyinfo.KeyInfoCriteria
DEBUG BaseSignatureTrustEngine - Failed to verify signature and/or 
establish trust using any KeyInfo-derived credentials
DEBUG ExplicitKeySignatureTrustEngine - Attempting to verify signature 
using trusted credentials
DEBUG ExplicitKeySignatureTrustEngine - Failed to verify signature using 
either KeyInfo-derived or directly trusted credentials
DEBUG SAMLProtocolMessageXMLSignatureSecurityPolicyRule - Validation of 
protocol message signature failed for context issuer 
'https://int.mypostbusiness.ch/idp/', message type: 
{urn:oasis:names:tc:SAML:2.0:protocol}Response
2012-12-21 14:22:54.372:WARN:oejs.ServletHandler:/saml/SSO
org.opensaml.common.SAMLRuntimeException: Incoming SAML message is invalid
	at 
org.springframework.security.saml.SAMLProcessingFilter.attemptAuthentication(SAMLProcessingFilter.java:95)


[1] 
http://www.oasis-open.org/committees/download.php/35623/sstc-saml-holder-of-key-browser-sso-cd-03.odt

-- Andreas