<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">Hi,<div class=""><br class=""></div><div class="">I am using xmlsectool to sign a SAML entitiesDescriptor document with the following command:</div><div class=""><br class=""></div><div class=""><div style="margin: 0px; font-size: 11px; font-family: Monaco;" class="">./xmlsectool.sh --sign --referenceIdAttributeName <span style="color: #021fac" class="">someID</span> --inFile <span style="color: #021fac" class="">fileToSign</span> --outFile <span style="color: #021fac" class="">signedFile</span> --digest SHA-256 --signatureAlgorithm <a href="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256" class="">http://www.w3.org/2001/04/xmldsig-more#rsa-sha256</a> --key <span style="color: rgb(2, 31, 172);" class="">keyFile</span> --certificate <span style="color: rgb(2, 31, 172);" class="">certificateFile</span></div></div><div class=""><span style="color: #021fac" class=""><br class=""></span></div><div class=""><br class=""></div><div class="">Despite using the referenceIdAttribute option, the outputted signed (and valid) document still have an empty ds:reference URI.</div><div class=""><br class=""></div><div class=""><ds:SignedInfo><br class=""><ds:CanonicalizationMethod Algorithm="<a href="http://www.w3.org/2001/10/xml-exc-c14n#" class="">http://www.w3.org/2001/10/xml-exc-c14n#</a>"/><br class=""><ds:SignatureMethod Algorithm="<a href="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256" class="">http://www.w3.org/2001/04/xmldsig-more#rsa-sha256</a>"/><br class=""><b class=""><ds:Reference URI=""></b><br class=""><ds:Transforms><br class=""><ds:Transform Algorithm="<a href="http://www.w3.org/2000/09/xmldsig#enveloped-signature" class="">http://www.w3.org/2000/09/xmldsig#enveloped-signature</a>"/><br class=""><ds:Transform Algorithm="<a href="http://www.w3.org/2001/10/xml-exc-c14n#" class="">http://www.w3.org/2001/10/xml-exc-c14n#</a>"/><br class=""></ds:Transforms><br class=""><ds:DigestMethod Algorithm="<a href="http://www.w3.org/2001/04/xmlenc#sha256" class="">http://www.w3.org/2001/04/xmlenc#sha256</a>"/><br class=""><ds:DigestValue>Aea81qu6rgtilqMgq/yR7AWDr4mFxvAKLi3xJEwVKrY=</ds:DigestValue><br class=""></ds:Reference></div><div class=""><br class=""></div><div class=""><br class=""></div><div class="">I know that it will not be a problem for the major SAML2 softwares but I am "curious ยป. So, is it a bug or a misconfiguration somewhere ? </div><div class=""><br class=""></div><div class="">Regards,</div></body></html>