How to create a SAML2 <AuthnRequest> with an embedded <Signature> using Shibboleth SP3

[Joosten, Peter]

Hello reader,

We have a working setup with Shibboleth SP3 to authenticate against a broker. The AuthnRequest is unsigned at this moment.
In the near future we have to use AuthnRequest with an embedded <Signature>

I have no clue how to do it, at this moment. Can someone send me in de right direction?
Where to look on the internet, a sample shibboleth2.xml config file, tips, hints.

I have read https://shibboleth.atlassian.net/wiki/spaces/SP3/pages/2065334379/SigningEncryption, but I am still strugling

Peter Joosten

Unsigned autnrequest
---------------------

<samlp:AuthnRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
                    AssertionConsumerServiceIndex="2"
                    AttributeConsumingServiceIndex="1"
                    Destination="https://eh.pre.signicat.nl/broker/sp/eh/1.9/login"
                    ID="_45c3107705cd31eca7403b09d3b3f010"
                    IssueInstant="2022-02-16T11:15:54Z"
                    Version="2.0">

  <saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">urn:etoegang:DV:00000003309999999999:entities:0001</saml:Issuer>
  <samlp:NameIDPolicy AllowCreate="1" />
  <samlp:RequestedAuthnContext Comparison="minimum">
    <saml:AuthnContextClassRef xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">urn:etoegang:core:assurance-class:loa2</saml:AuthnContextClassRef>
  </samlp:RequestedAuthnContext>
</samlp:AuthnRequest>

Signedn autnrrequest  (this is our goal)
----------------------------------------

<samlp:AuthnRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
                    AssertionConsumerServiceIndex="2"
                    AttributeConsumingServiceIndex="1"
                    Destination="https://eh.pre.signicat.nl/broker/sp/eh/1.11/login"
                    ID="_45c3107705cd31eca7403b09d3b3f010"
                    IssueInstant="2022-02-16T11:15:54Z"
                    Version="2.0">

  <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
    <ds:SignedInfo>
      <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
      <ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/>
      <ds:Reference URI="">
        <ds:Transforms>
          <ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
          <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
        </ds:Transforms>
        <ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
        <ds:DigestValue>8P3ofQ4DX8dNbzEJv1UhRZec7gYlP6rh9R5f4tyafYs=</ds:DigestValue>
      </ds:Reference>
    </ds:SignedInfo>
    <ds:SignatureValue>E/uC3m9jfH98D8IG9Rtqls+f8OYtv6oukrl7P3C259YyRtdhLkjFGADQ6iJuy10E
NrlMuJjoCWhhBdLpEQgLPxidbGEjwFNT3ec5YpnIN2mZNd2+/i4Ejrjx/i5PfpKo
EsOTIzbzaGdoIP6SF/1WVz5/+5TIl4qKo2mAqszsUQTk4TolP7Nl8FqCJQfD08Up
6Tpo0Sc8EL8TH1s+A9Uc1qaFe1A1pY8LUrfbnThvQlsTWqVF1VuYgjL1z2tYOCSw
cgnxjvh9M0kUhZgPVmAaKLiR3eg0RTPIpDVpO7OJlH1zvV/4eUuIgxbFNrF3GkF4
eBWn7l91Ttq3LS8F/dBb6Q==</ds:SignatureValue>
  </ds:Signature>

  <saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">urn:etoegang:DV:00000003309999999999:entities:0001</saml:Issuer>
  <samlp:NameIDPolicy AllowCreate="1" />
  <samlp:RequestedAuthnContext Comparison="minimum">
    <saml:AuthnContextClassRef xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">urn:etoegang:core:assurance-class:loa2</saml:AuthnContextClassRef>
  </samlp:RequestedAuthnContext>
</samlp:AuthnRequest>


This e-mail and the documents attached are confidential and intended solely for the addressee; it may also be privileged. If you receive this e-mail in error, please notify the sender immediately and destroy it. As its integrity cannot be secured on the Internet, Atos’ liability cannot be triggered for the message content. Although the sender endeavours to maintain a computer virus-free network, the sender does not warrant that this transmission is virus-free and will not be liable for any damages resulting from any virus transmitted. On all offers and agreements under which Atos Nederland B.V. supplies goods and/or services of whatever nature, the Terms of Delivery from Atos Nederland B.V. exclusively apply. The Terms of Delivery shall be promptly submitted to you on your request.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20220216/5d6adbf3/attachment.htm>