Chad, thanks for your answer. Sorry for my funny english, but the question was for me more related to OpenSAML, and not to <div>wsse4j. </div><div><br></div><div>The two assertions are semantically the same, so I can't understand why the signature fails. <br>
<div><br></div><div><br><br><div class="gmail_quote">On Fri, Aug 3, 2012 at 12:32 PM, Chad La Joie <span dir="ltr"><<a href="mailto:lajoie@itumi.biz" target="_blank">lajoie@itumi.biz</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
OpenSAML questions need to be sent to the dev list. WSSE4J question,<br>
which this is, needs to be sent to their mailing list.<br>
<div class="HOEnZb"><div class="h5"><br>
On Fri, Aug 3, 2012 at 6:29 AM, <a href="mailto:massimiliano.masi@gmail.com">massimiliano.masi@gmail.com</a><br>
<<a href="mailto:massimiliano.masi@gmail.com">massimiliano.masi@gmail.com</a>> wrote:<br>
> Hi All,<br>
><br>
> Using OpenSAML I correctly validate the signature of an assertion that has<br>
> as Subject Confirmation Data the following<br>
><br>
> <wsse:SecurityTokenReference<br>
><br>
> xmlns:wsse="<a href="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" target="_blank">http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd</a>"><br>
> <wsse:KeyIdentifier<br>
><br>
> ValueType="<a href="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentifier" target="_blank">http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentifier</a>"><br>
> Ytig1daWMVvZKbESb1W10TpDcJY=<br>
> </wsse:KeyIdentifier><br>
><br>
> </wsse:SecurityTokenReference><br>
><br>
><br>
> When I add this assertion (using wsse4j) to the security header, DOM is<br>
> pushing the namespace in the security header element, as:<br>
><br>
> <wsse:Security<br>
> xmlns:wsse="<a href="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" target="_blank">http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd</a>"><br>
> <saml2:Assertion<br>
><br>
><br>
> causing the keyInfo of the Subject Confirmation Data to be:<br>
><br>
><br>
> <wsse:SecurityTokenReference><wsse:KeyIdentifier<br>
> ValueType="<a href="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentifier" target="_blank">http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentifier</a>">Ytig1daWMVvZKbESb1W10TpDcJY=</wsse:KeyIdentifier></wsse:SecurityTokenReference><br>
><br>
><br>
> and this seems to break the validation of the saml assertion:<br>
><br>
><br>
> Caused by: org.opensaml.xml.validation.ValidationException: Signature did<br>
> not validate against the credential's key<br>
><br>
> at<br>
> org.opensaml.xml.signature.SignatureValidator.validate(SignatureValidator.java:78)<br>
><br>
><br>
> How to avoid this situation? The assertion's SignedInfo is:<br>
><br>
><br>
> <ds:SignedInfo><br>
><br>
> <ds:CanonicalizationMethod<br>
> Algorithm="<a href="http://www.w3.org/2001/10/xml-exc-c14n#" target="_blank">http://www.w3.org/2001/10/xml-exc-c14n#</a>"/><br>
><br>
> <ds:SignatureMethod<br>
> Algorithm="<a href="http://www.w3.org/2000/09/xmldsig#rsa-sha1" target="_blank">http://www.w3.org/2000/09/xmldsig#rsa-sha1</a>"/><br>
><br>
> <ds:Reference URI="#uuid-d8840a0d-fa90-4522-806e-edc8dc427d2b"><br>
><br>
> <ds:Transforms><br>
><br>
> <ds:Transform<br>
> Algorithm="<a href="http://www.w3.org/2000/09/xmldsig#enveloped-signature" target="_blank">http://www.w3.org/2000/09/xmldsig#enveloped-signature</a>"/><br>
><br>
> <ds:Transform<br>
> Algorithm="<a href="http://www.w3.org/2001/10/xml-exc-c14n#" target="_blank">http://www.w3.org/2001/10/xml-exc-c14n#</a>"/><br>
><br>
> </ds:Transforms><br>
><br>
> <ds:DigestMethod<br>
> Algorithm="<a href="http://www.w3.org/2000/09/xmldsig#sha1" target="_blank">http://www.w3.org/2000/09/xmldsig#sha1</a>"/><br>
><br>
> <ds:DigestValue>ghAD3gMLcZvyXFhVXJwNkeHCGi8=</ds:DigestValue><br>
><br>
> </ds:Reference><br>
><br>
> </ds:SignedInfo><br>
><br>
><br>
> AFAIK, the two xmls are semantically equivalent, thus the signature shall<br>
> behave the same, or am I wrong?<br>
><br>
><br>
> Thanks a lot,<br>
><br>
><br>
> Massi<br>
><br>
><br>
><br>
> --<br>
> Massimiliano Masi<br>
><br>
> <a href="http://www.mascanc.net/~max" target="_blank">http://www.mascanc.net/~max</a><br>
><br>
</div></div><span class="HOEnZb"><font color="#888888">> --<br>
> To unsubscribe from this list send an email to<br>
> <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
<br>
<br>
<br>
--<br>
Chad La Joie<br>
<a href="http://www.itumi.biz" target="_blank">www.itumi.biz</a><br>
trusted identities, delivered<br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
</font></span></blockquote></div><br><br clear="all"><div><br></div>-- <br>Massimiliano Masi<br><br><a href="http://www.mascanc.net/~max">http://www.mascanc.net/~max</a><br>
</div></div>