Unable to establish security of incoming assertion

[Cantor, Scott]

On 2/19/14, 10:16 AM, "Dewberry, James" <JDewberry at nfp.com> wrote:
>
>The client swears up and down that the signature is valid, but I¹m not
>too familiar with how the signature stuff works.

Well, either they're wrong, or their metadata/key is.

>Do you have any suggestions on:
>
>1. How can I validate the signature myself?

At minimum you have to recover the raw unmolested XML from the submission
or from the log (catching it in the form is the best, since there's no
possibility of getting corruption when you directly decode the base64).
You can try feeding it into tools like Oxygen, or possibly the xmlsec
project's web page.

>2. Is there any configuration I can do to get the signature verified?

Not likely, no.

>3. Any thoughts on what I can do next?

https://wiki.shibboleth.net/confluence/display/OpenSAML/OSTwoUserManSigErro
rs

>4. Are they using a signature method that Shibboleth doesn¹t like?

No. The signature they provided is not technically valid SAML (it's
missing a Reference ID) but it's a common thing to do it the way they did
it and Shibboleth wouldn't reject it. The problem here is the signature
computation or the key.

Practically speaking, the question to ask is what the IdP is. If it's a
known-good implementation, then the problem is the key/metadata. If not,
there is no way to know easily.

-- Scott