<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<br>
<br>
<div class="moz-cite-prefix">On 10/21/15 12:46 PM, Cantor, Scott
wrote:<br>
</div>
<blockquote cite="mid:83174A74-14D4-46AB-A765-FAB1D566ADB5@osu.edu"
type="cite">
<pre wrap="">
That could also be the problem. The Redirect binding may not be following quite the same rules for padding and such.</pre>
</blockquote>
<br>
The would line up with the originally reported error with the
redirect, which sounds like a data encoding/representation issue:<br>
<br>
<pre wrap="">Caused by: java.io.IOException: Sequence tag error
at sun.security.util.DerInputStream.getSequence(DerInputStream.java:297)</pre>
<br>
I guess there's something that's ASN.1 here? Not clear to me what
that would be, other than the PublicKey. Is there ASN.1 in the
actual signature bytes? The cert/publicKey is not even sent by the
SP in this binding, it's coming from metadata. And if there were an
issue there, I'd think it would fail when it parses the KeyInfo data
into the PublicKey, not a verify time. <br>
<br>
<br>
<blockquote cite="mid:83174A74-14D4-46AB-A765-FAB1D566ADB5@osu.edu"
type="cite">
<pre wrap="">I don't even recall what the SAML spec says about that.</pre>
</blockquote>
<br>
<br>
I took a quick look and SAML 2 Bindings doesn't really seem to say
anything about the particulars of the crypto padding or other
details. Just covers the construction of the string to be signed.
Since RSA works, I wouldn't think the issue would be there. But who
knows... <br>
</body>
</html>