sp(2.5.5) <-> idp(3.1.2) and ecdsa certs

[Cantor, Scott]

On 10/21/15, 12:36 PM, "users on behalf of Brent Putman" <users-bounces at shibboleth.net on behalf of putmanb at georgetown.edu> wrote:



>Actually the first case of the Redirect binding signature failing validation at the IdP isn't Santuario. It's not involved at all, because it's not XML.  Just plain old use of the Java JCA Signature class.  (That's the Java side.  I assume on the SP side you're just using openssl directly to compute the raw signature?)

No, I actually still use Santuario, because I have access to the raw routines that do the work underneath the XML layer. That was by design, I reworked all that when I took over the library, so that I could minimize differences between cases and not have to maintain two crypto stacks. They both use OpenSSL underneath, but OpenSSL is very low level. There's much more to making it all actually work than just calling those functions, which is why I botched it several times.

That could also be the problem. The Redirect binding may not be following quite the same rules for padding and such. I don't even recall what the SAML spec says about that.

-- Scott