XML signature with samlsign and xmlsec1

[Paolo Smiraglia]

Hi guys, I've a question for you about XML signature made with "samlsign" tool.

I'm not sure this is the right place to ask. If not, sorry for the OT.

Let's go into details...

* The signer certificate (self-signed) has been generated by setting
the subjectAlternativeName to "DNS:<FQDN>,URI:<ENTITY_ID>"

* The original xml document (SAML metadata generated with
"metagen.sh") has been signed with "samlsign"

* The resulting signed metadata contains under <KeyInfo> two <KeyName>
elements with the signer FQDN and ENTITY_ID (as in the certificate)

Now, if I try to verify the signed metadata with "samlsign",
everything goes well. On the contrary, if I try the same process with
xmlsec1, the signature verification fails due to the presence of
multiple <KeyName> elements.

I tried to generate a new signer certificate with
subjectAlternativeName set only to "DNS:<FQDN>" or "URI:<ENTITY_ID>".
The resulting signed metadata (signed with samlsign) has only one
<KeyName> and the verification with xmlsec1 goes well.

What's wrong?

Bests,

   Paolo

-- 
PAOLO SMIRAGLIA