sp(2.5.5) <-> idp(3.1.2) and ecdsa certs

[Jarno Huuskonen]

Hi,

On Mon, Oct 19, Brent Putman wrote:
> 
> 
> On 10/19/15 8:17 PM, Brent Putman wrote:
> >
> >
> > So yeah, disappointing, I thought this "just worked".  Definitely
> > something we need to look at in more depth.  I guess the issue could
> > be on either end at this point.
> 
> Doh, eureka!  I just realized that I was only testing the Redirect
> binding simple signature.  I switched the SP to use the POST binding
> with an AuthnRequest signed at the XML level - and it works!  Tried a
> couple of permutations of curves and digest methods, and they all work fine.

Thanks, I can confirm that it works with POST binding.

(I had to disable encryption for that SP in (idp: relying-party.xml),
this is probably because xmlenc keytransport algorithms
use rsa?:
http://www.w3.org/TR/2002/REC-xmlenc-core-20021210/Overview.html#rsa-1_5)

(BTW(forgot to mention) that IDP still has rsa certificate, only the
test SP has ecdsa cert).

It's possible to verify (POST) samlp:AuthnRequest signature with
xmlsectool.sh:
- get the base64 encoded SAMLResponse: (from firefox+samltracer)
- base64 -d the b64resp > authnrequest.xml
- xmlsectool.sh --verifySignature  --signatureRequired --certificate \
  sp.crt --inFile authnrequest.xml

> So the problem is just with the non-XML signature used by the Redirect
> binding.  That at least narrows the problem down.  Still doesn't tell us
> whether the issue is on the IdP or SP end.
> 
> Just for fun, I'll see if I can now get the IdP to sign with ECDSA and
> whether the SP accepts it...

I tested that SP can verify ecdsa signed metadata, so ecdsa signed
response probably works.

-Jarno

-- 
Jarno Huuskonen