XMLsectool not populating the ds:reference URI

[Mehdi Hached]

Hi,

I am using xmlsectool to sign a SAML entitiesDescriptor document with the following command:

./xmlsectool.sh --sign --referenceIdAttributeName someID --inFile fileToSign --outFile signedFile --digest SHA-256 --signatureAlgorithm http://www.w3.org/2001/04/xmldsig-more#rsa-sha256 --key keyFile --certificate certificateFile


Despite using the referenceIdAttribute option, the outputted signed (and valid) document still have an empty ds:reference URI.

<ds:SignedInfo>
<ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
<ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/>
<ds:Reference URI="">
<ds:Transforms>
<ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
<ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
</ds:Transforms>
<ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
<ds:DigestValue>Aea81qu6rgtilqMgq/yR7AWDr4mFxvAKLi3xJEwVKrY=</ds:DigestValue>
</ds:Reference>


I know that it will not be a problem for the major SAML2 softwares but I am "curious ». So, is it a bug or a misconfiguration somewhere ? 

Regards,
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20150312/e83c946d/attachment.html