Hi All, <div><br></div><div>Using OpenSAML I correctly validate the signature of an assertion that has as Subject Confirmation Data the following </div><div><br></div><p style="margin:0px;font-size:12px;font-family:Helvetica;color:rgb(171,69,0)">
<span style="color:#000000"> </span><span style="color:#021da7"><wsse:SecurityTokenReference</span><span style="color:#f9975e"> </span><span style="color:#000000"><br>
</span><span style="color:#f9975e"> </span><span style="color:#00aad6">xmlns:wsse</span><span style="color:#ff9450">=</span>"<a href="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd</a>"<span style="color:#021da7">></span><span style="color:#000000"><br>
</span><span style="color:#021da7"><wsse:KeyIdentifier</span><span style="color:#f9975e"> </span><span style="color:#000000"><br>
</span><span style="color:#f9975e"> ValueType</span><span style="color:#ff9450">=</span>"<a href="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentifier">http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentifier</a>"<span style="color:#021da7">></span><span style="color:#000000"><br>
Ytig1daWMVvZKbESb1W10TpDcJY=<br>
</span><span style="color:#021da7"></wsse:KeyIdentifier></span><span style="color:#000000"><br></span></p><div><span style="font-family:Helvetica;font-size:12px"> </span><span style="font-family:Helvetica;font-size:12px;color:rgb(2,29,167)"></wsse:SecurityTokenReference></span></div>
<div><br></div><div> <br clear="all"><div>When I add this assertion (using wsse4j) to the security header, DOM is pushing the namespace in the security header element, as:</div><div><br></div><div><p style="margin:0px;font-size:12px;font-family:Helvetica;color:rgb(171,69,0)">
<span style="color:#021da7"><wsse:Security</span><span style="color:#f9975e"> </span><span style="color:#00aad6">xmlns:wsse</span><span style="color:#ff9450">=</span>"<a href="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd</a>"<span style="color:#021da7">></span><span style="color:#000000"><br>
</span><span style="color:#021da7"><saml2:Assertion</span></p><p style="margin:0px;font-size:12px;font-family:Helvetica;color:rgb(171,69,0)"><span style="color:#021da7"><br></span></p><p style="margin:0px;font-size:12px;font-family:Helvetica;color:rgb(171,69,0)">
<span style="color:rgb(0,0,0);font-family:arial;font-size:small">causing the keyInfo of the Subject Confirmation Data to be: </span></p><p style="margin:0px;font-size:12px;font-family:Helvetica;color:rgb(171,69,0)"><span style="color:rgb(0,0,0);font-family:arial;font-size:small"><br>
</span></p><p style="margin:0px"></p><p style="color:rgb(171,69,0);font-family:Helvetica;font-size:12px;margin:0px"><span style="color:#021da7"><wsse:SecurityTokenReference><wsse:KeyIdentifier</span><span style="color:#f9975e"> ValueType</span><span style="color:#ff9450">=</span>"<a href="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentifier">http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentifier</a>"<span style="color:#021da7">></span><span style="color:#000000">Ytig1daWMVvZKbESb1W10TpDcJY=</span><span style="color:#021da7"></wsse:KeyIdentifier></wsse:SecurityTokenReference></span></p>
<p style="color:rgb(171,69,0);font-family:Helvetica;font-size:12px;margin:0px"><span style="color:#021da7"><br></span></p><p style="color:rgb(171,69,0);font-family:Helvetica;font-size:12px;margin:0px"><span style="color:rgb(0,0,0);font-family:arial;font-size:small">and this seems to break the validation of the saml assertion:</span></p>
<p style="color:rgb(171,69,0);font-family:Helvetica;font-size:12px;margin:0px"><span style="color:rgb(0,0,0);font-family:arial;font-size:small"><br></span></p><p style="color:rgb(171,69,0);font-family:Helvetica;font-size:12px;margin:0px">
Caused by: org.opensaml.xml.validation.ValidationException: Signature did not validate against the credential's key</p><p style="color:rgb(171,69,0);font-family:Helvetica;font-size:12px;margin:0px"><span class="Apple-tab-span" style="white-space:pre"> </span>at org.opensaml.xml.signature.SignatureValidator.validate(SignatureValidator.java:78)</p>
<p style="color:rgb(171,69,0);font-family:Helvetica;font-size:12px;margin:0px"><span style="color:rgb(0,0,0);font-family:arial;font-size:small"><br></span></p><p style="margin:0px">How to avoid this situation? The assertion's SignedInfo is: </p>
<p style="margin:0px"><br></p><p style="margin:0px"></p><p style="margin:0px"> <ds:SignedInfo></p><p style="margin:0px"> <ds:CanonicalizationMethod Algorithm="<a href="http://www.w3.org/2001/10/xml-exc-c14n#">http://www.w3.org/2001/10/xml-exc-c14n#</a>"/></p>
<p style="margin:0px"> <ds:SignatureMethod Algorithm="<a href="http://www.w3.org/2000/09/xmldsig#rsa-sha1">http://www.w3.org/2000/09/xmldsig#rsa-sha1</a>"/></p><p style="margin:0px"> <ds:Reference URI="#uuid-d8840a0d-fa90-4522-806e-edc8dc427d2b"></p>
<p style="margin:0px"> <ds:Transforms></p><p style="margin:0px"> <ds:Transform Algorithm="<a href="http://www.w3.org/2000/09/xmldsig#enveloped-signature">http://www.w3.org/2000/09/xmldsig#enveloped-signature</a>"/></p>
<p style="margin:0px"> <ds:Transform Algorithm="<a href="http://www.w3.org/2001/10/xml-exc-c14n#">http://www.w3.org/2001/10/xml-exc-c14n#</a>"/></p><p style="margin:0px"> </ds:Transforms></p>
<p style="margin:0px"> <ds:DigestMethod Algorithm="<a href="http://www.w3.org/2000/09/xmldsig#sha1">http://www.w3.org/2000/09/xmldsig#sha1</a>"/></p><p style="margin:0px"> <ds:DigestValue>ghAD3gMLcZvyXFhVXJwNkeHCGi8=</ds:DigestValue></p>
<p style="margin:0px"> </ds:Reference></p><p style="margin:0px"> </ds:SignedInfo></p><p style="margin:0px"><br></p><p style="margin:0px">AFAIK, the two xmls are semantically equivalent, thus the signature shall behave the same, or am I wrong?</p>
<p style="margin:0px"><br></p><p style="margin:0px">Thanks a lot, </p><p style="margin:0px"><br></p><p style="margin:0px"> Massi</p><p style="margin:0px"><br></p><p style="margin:0px"><br></p><p></p><p></p></div>-- <br>
Massimiliano Masi<br><br><a href="http://www.mascanc.net/~max">http://www.mascanc.net/~max</a><br>
</div>