<html><head>
<meta http-equiv="content-type" content="text/html; charset=ISO-8859-1">
</head><body style="color: rgb(0, 0, 0); background-color: rgb(255, 255,
255);" bgcolor="#FFFFFF" text="#000000">
I work with the Canvas LMS (<a class="moz-txt-link-freetext" href="http://www.instructure.com">http://www.instructure.com</a>). We support
Single Sign On via Shibboleth where Canvas is the SP. We have several
customers reporting problems getting this to work when using the
shibboleth IdP version 2.3.8. It would appear that all of the problems
stem from a problem verifying the Signature Digest.<br>
<br>
I have captured and attached an assertion from the IdP that says it is
canonicalized using xml-exc-c14n, "Exclusive Canonical XML 1.0", and
when Canvas tries to validate the assertion after Canonicalizing it this
way according to that specification it fails. But, when we force
Canvas to use
Canonical XML 1.0, xml-c14n, it works.<br>
<br>
Canvas uses a modified version of OneLogin's ruby-saml gem to support
SAML. It has a file for, among other things, Canonicalization. You can
see the code for this at
<a class="moz-txt-link-freetext" href="https://github.com/bracken/ruby-saml/blob/original_version/lib/xml_sec.rb">https://github.com/bracken/ruby-saml/blob/original_version/lib/xml_sec.rb</a>
on ~line 57 where the canonicalization method is selected based on the
algorithm in the assertion. <br>
<br>
This tells me one of two things. Either the Shibboleth assertion is
canonicalized one way (xml-c14n) and reporting another (xml-exc-c14n) or
the xmlsec library behind the ruby module has a problem. Because we
think we only have problems with Shibboleth assertions from this
version, we suspect the former but that is why we're posting to this
list.<br>
<br>
Is anyone aware of this type of problem? If this questions is more
appropriately posted somewhere else, let me know.<br>
<br>
<div class="moz-signature">-- <br><span><span><span><font><font
face="verdana, sans-serif"><span><span><span><b style="font-family:
arial,sans-serif; font-style: normal; font-variant: normal;
letter-spacing: normal; line-height: normal; orphans: 2; text-indent:
0px; text-transform: none; white-space: normal; widows: 2; word-spacing:
0px; font-size: 13px; color: rgb(34, 34, 34);"><font face="verdana,
sans-serif" size="1">Kevin Hansen</font></b></span></span></span><b><font
face="verdana, sans-serif" size="1"><br></font></b></font></font></span></span></span><span><span><br>
</span></span><br>
<br>
</div>
</body></html>