XML signature with samlsign and xmlsec1

[Paolo Smiraglia]

On Fri, 29 Jun 2018 at 10:57, Peter Schober <peter.schober at univie.ac.at> wrote:
>
> Since this is not the list for xmlsec1 what is it you're asking here?

Because my trouble with xmlsec1 is related to samlsign, which is (in
my understanding) a shibboleth affiliated tool.

Anyway, as I wrote in the post script, sorry for possible OT.

> Whether what samlsign did is technically correct?

I hope yes...

> How are you calling xmlsec1? E.g.
>
> $ xmlsec1 --verify --id-attr:ID \
>   urn:oasis:names:tc:SAML:2.0:metadata:EntitiesDescriptor \
>   --trusted-pem $CERT --pubkey-cert-pem $CERT $XML

$ xmlsec1 --verify --id-attr:ID
urn:oasis:names:tc:SAML:2.0:metadata:EntityDescriptor
--pubkey-cert-pem cert.pem metadata.xml
func=xmlSecKeyDataNameXmlRead:file=keyinfo.c:line=723:obj=key-name:subj=key
name is already specified:error=41:invalid key data:
func=xmlSecKeyInfoNodeRead:file=keyinfo.c:line=114:obj=key-name:subj=xmlSecKeyDataXmlRead:error=1:xmlsec
library function failed:node=KeyName
func=xmlSecKeysMngrGetKey:file=keys.c:line=1349:obj=unknown:subj=xmlSecKeyInfoNodeRead:error=1:xmlsec
library function failed:node=KeyInfo
func=xmlSecDSigCtxProcessKeyInfoNode:file=xmldsig.c:line=871:obj=unknown:subj=unknown:error=45:key
is not found:
func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=565:obj=unknown:subj=xmlSecDSigCtxProcessKeyInfoNode:error=1:xmlsec
library function failed:
func=xmlSecDSigCtxVerify:file=xmldsig.c:line=366:obj=unknown:subj=xmlSecDSigCtxSignatureProcessNode:error=1:xmlsec
library function failed:
Error: signature failed
ERROR
SignedInfo References (ok/all): 1/1
Manifests References (ok/all): 0/0
Error: failed to verify file "metadata.xml"

> Does XmlSecTool verify the signature? Does the Shib IDP or SP?

$ ./xmlsectool.sh --verifySignature --inFile metadata.xml --certificate cert.pem
INFO  XMLSecTool - Reading XML document from file 'metadata.xml'
INFO  XMLSecTool - XML document parsed and is well-formed.
INFO  XMLSecTool - XML document signature verified.

$ samlsign -c ./cert.pem -f metadata.xml
$ echo $?
0

Since samlsign and xmlsectool validates, it seems to be an xmlsec1
problem. Thanks for the hints...


-- 
PAOLO SMIRAGLIA