Can the MDA add entity attributes?

[Wessel, Keith]

Seems like a logical test, Ian. I just tried it and, sure enough when I don't add any entity attributes, the transform right after the disassemble stage and signing at the end results in a valid signature.

So, sounds like you nailed this one. I'll keep my workaround of doing a transform just before signing (or any time after adding entity attributes) until the release of 1.0.0 when I can drop the explicit transform.

Thanks again for the help here! I'm super excited about replacing our local federation's publishing process with a long overdue improved one.

Keith


-----Original Message-----
From: Ian Young <ian at iay.org.uk> 
Sent: Thursday, September 12, 2024 10:41 AM
To: Shib Users <users at shibboleth.net>
Cc: Wessel, Keith <kwessel at illinois.edu>
Subject: Re: Can the MDA add entity attributes?



> On 12 Sep 2024, at 15:42, Wessel, Keith via users <users at shibboleth.net> wrote:
> 
> If you still care and if it helps, I was doing this after disassembly:


I think I care in principle, because it's always bad not to be sure why something used to happen, even if you now think it never will. In practice, I'm inclined to think it's not important if I am relatively sure it can no longer recur _wherever_ the issue is coming up, which is where I think we are now.

The bottom line is that the DOM representation has two ways of describing element namespaces, and they can be mismatched. The serialisation that is done on writing to a file brings these representations together so this is almost always invisible in practice, but the serialisation done to perform signatures does not so this so you can end up signing something different to the document you then write out. In principle any stage which creates new elements within the document could introduce a divergent representation: I suspect that in your case it's the stage adding entity attributes which is causing the problem, but the same thing that is doing is done essentially everywhere so detecting, debugging and correcting each such case is much less attractive than the 1.0.0 solution which is to normalise the document just before signature. That should fix the issue for any case involving signatures, and any case _not_ involving signatures is caught by the usual serialiser.

If you did want to do one confirming test, you could move the identity transform back to just after the disassembly and remove the stage doing the adding of entity attributes. If signatures were coming out right in that case, that would confirm that stage as the culprit. It would also strengthen my feeling that chasing this class of issues is pointless and what I've done is the right approach.

Cheers,

    -- Ian