invalid assertion from Shibboleth IdP 2.3.8

[Kevin Hansen]

I work with the Canvas LMS (http://www.instructure.com).  We support 
Single Sign On via Shibboleth where Canvas is the SP.  We have several 
customers reporting problems getting this to work when using the 
shibboleth IdP version 2.3.8.  It would appear that all of the problems 
stem from a problem verifying the Signature Digest.

I have captured and attached an assertion from the IdP that says it is 
canonicalized using xml-exc-c14n,  "Exclusive Canonical XML 1.0", and 
when Canvas tries to validate the assertion after Canonicalizing it this 
way according to that specification it fails.  But, when we force Canvas 
to use Canonical XML 1.0, xml-c14n, it works.

Canvas uses a modified version of OneLogin's ruby-saml gem to support 
SAML.  It has a file for, among other things, Canonicalization.  You can 
see the code for this at 
https://github.com/bracken/ruby-saml/blob/original_version/lib/xml_sec.rb on 
~line 57 where the canonicalization method is selected based on the 
algorithm in the assertion.

This tells me one of two things.  Either the Shibboleth assertion is 
canonicalized one way (xml-c14n) and reporting another (xml-exc-c14n) or 
the xmlsec library behind the ruby module has a problem.  Because we 
think we only have problems with Shibboleth assertions from this 
version, we suspect the former but that is why we're posting to this list.

Is anyone aware of this type of problem?  If this questions is more 
appropriately posted somewhere else, let me know.

-- 
*Kevin Hansen**
*


-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20120720/714e587f/attachment-0001.html 
-------------- next part --------------
An embedded and charset-unspecified text was scrubbed...
Name: brads_assertion.b64.txt
Url: http://shibboleth.net/pipermail/users/attachments/20120720/714e587f/attachment-0001.txt