sp(2.5.5) <-> idp(3.1.2) and ecdsa certs

[Brent Putman]

On 10/21/15 10:11 AM, Cantor, Scott wrote:

>> I changed idp to use ecdsa cert -> SP fails to validate ecdsa signed
>> saml2p:Response. (Also xmlsectool.sh and xmlsec1 fail to validate this
>> ecdsa signed response:
> That's fairly indicative that there's perhaps a regression in Santuario 2.x.

I'm nominally agree, but...

>
> and doesn't work:
> - IDP fails when SP sends ecdsa signed request to Redirect binding
> - SP fails to verify ecdsa response from IDP
> In in both those cases, that's Santuario 2.x computing the signature (to verify it or to create it), so that fits that hypothesis.

Actually the first case of the Redirect binding signature failing
validation at the IdP isn't Santuario. It's not involved at all,
because it's not XML.  Just plain old use of the Java JCA Signature
class.  (That's the Java side.  I assume on the SP side you're just
using openssl directly to compute the raw signature?)

The second is Santuario of course.

AFAIK the only thing in common between the 2 would be the JCA Signature
support (which Santuario uses internally).  So either there's a
fundamental issue there (seems unlikely? we wouldn't be the first to
encounter I think), or else the 2 cases are failing for probably
unrelated reasons.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20151021/a8d46765/attachment-0001.html>