Can the MDA add entity attributes?

[Ian Young]

> On 12 Sep 2024, at 15:42, Wessel, Keith via users <users at shibboleth.net> wrote:
> 
> If you still care and if it helps, I was doing this after disassembly:


I think I care in principle, because it's always bad not to be sure why something used to happen, even if you now think it never will. In practice, I'm inclined to think it's not important if I am relatively sure it can no longer recur _wherever_ the issue is coming up, which is where I think we are now.

The bottom line is that the DOM representation has two ways of describing element namespaces, and they can be mismatched. The serialisation that is done on writing to a file brings these representations together so this is almost always invisible in practice, but the serialisation done to perform signatures does not so this so you can end up signing something different to the document you then write out. In principle any stage which creates new elements within the document could introduce a divergent representation: I suspect that in your case it's the stage adding entity attributes which is causing the problem, but the same thing that is doing is done essentially everywhere so detecting, debugging and correcting each such case is much less attractive than the 1.0.0 solution which is to normalise the document just before signature. That should fix the issue for any case involving signatures, and any case _not_ involving signatures is caught by the usual serialiser.

If you did want to do one confirming test, you could move the identity transform back to just after the disassembly and remove the stage doing the adding of entity attributes. If signatures were coming out right in that case, that would confirm that stage as the culprit. It would also strengthen my feeling that chasing this class of issues is pointless and what I've done is the right approach.

Cheers,

    -- Ian




-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 4151 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/users/attachments/20240912/529746de/attachment.p7s>