Debugging SAML2 AttributeQuery signature validation failure

[o haya]

Hi,

I implemented a Java app, "AttributeQueryGenerator.java", that constructs a
signed AttributeQuery request, a while ago, and, recently, have been trying
to test it with a Shibboleth 5.1.4 IdP, with AttributeQuery enable.  The
Java app uses OpenSAML 4.

It took awhile to get the certs and keys all setup and matched, and I've
been able to get test AttributeQuery requests to get processed by the
Shibboleth, to the point that Shibboleth attempts to validate the
signature, but so far, I have not been able to get the validation working.

When I send a request, I gat a SAML response with "RequestDenied",  and, in
the idp-process.log file, I get messages that say:

WARN  org.apache.xml.security.signature.XMLSignature - Signature
verification failed.
org.opensaml.xmlsec.signature.support.SignatureException:
  Signature cryptographic validation not successful
Environment

   -

   Shibboleth IdP: 5.1.4
   -

   Profile: SAML2 SOAP AttributeQuery
   -

   Custom Java client using OpenSAML 4
   -

   Signing algorithm: RSA-SHA256
   -

   Digest algorithm: SHA-256
   -

   Canonicalization: Exclusive C14N (omit comments)
   -

   Client certificate also used for mTLS

What Is Working

   -

   mTLS succeeds (client cert matches metadata and TLS handshake is
   successful).
   -

   Metadata for the requester entity is loaded correctly (from logs)
   -

   The IdP resolves the correct SPSSODescriptor and KeyDescriptor from
   metadata (from logs)
   -

   The certificate embedded in request KeyInfo file matches the metadata
   certificate (fingerprint and modulus confirmed).
   -

   At runtime, the private key modulus matches the certificate modulus
   (from logs)
   -

   Local verification inside the generator using Apache Santuario’s
   XMLSignature.checkSignatureValue(cert) returns *true*.
   -

   If I enable the " p:ignoreRequestSignatures="true"" parameter  in the
   relying-party.xml, the requests process successfully, and Shibboleth sends
   a SAML response with an AttributeStatement with Attribute and
   AtttibuteValues (!).

What Is Failing

The IdP logs show:

WARN  org.apache.xml.security.signature.XMLSignature - Signature
verification failed.org.opensaml.xmlsec.signature.support.SignatureException:
  Signature cryptographic validation not successful

This occurs after metadata credential resolution has succeeded, and the
correct signing credential is selected.

The response returned by the IdP is:

StatusCode=RequesterStatusCode=RequestDenied

Comments

As mentioned, I've checked the certs/keys and matched thumbprints, multiple
times, actually, so while I am not 100% sure, I thinkt the failure most
probably are due to crypto-related problems

   -

   Metadata lookup succeeds.
   -

   A credential is resolved.
   -

   Signature algorithm is accepted.
   -

   From logs, the verification seems to be failing during RSA cryptographic
   validation.

This suggests either:

   1.

   The data being signed differ from the data being verified
   (canonicalization / DOM mutation issue), or
   2.

   There is something incorrect about ID attribute handling or reference
   URI resolution.

Generator Structure

In the current implementation:

   1.

   SOAP Envelope DOM is built first.
   2.

   AttributeQuery is marshalled directly into the SOAP Body.
   3.

   queryElement.setIdAttributeNS(null, "ID", true) is called.
   4.

   Signer.signObject(signature) is called.
   5.

   No DOM moves occur after signing (as far as I have been able to observe)
   6.

   The request/document is serialized without pretty-printing.

Questions

   1.

   Are there additional logging categories (in logback) that might help
   visibility of:
   -

      Calculated vs expected digest values?
      -

      Reference URI resolution details?
      -

      Canonicalized SignedInfo output?
      2.

   Is there a recommended way within Shibboleth to dump canonicalized
   content used during signature verification?
   3.

   Are there known problems/gotchas specific to:
   -

      SOAP AttributeQuery signing
      -

      ID attribute registration in OpenSAML 4
      -

      Exclusive C14N handling in mixed SOAP + SAML DOM trees?

Any suggestions on any additional debugging techniques that Shibboleth IdP
can provide, or any other advice or suggestions, would be GREATLY
appreciated, because lately I have spent a ton of time trying to get past
the validation :(!!

Thanks in advance!!

Jim
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20260212/a5448ef4/attachment.htm>