<html><head><meta http-equiv="Content-Type" content="text/html charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><br class=""><div><blockquote type="cite" class=""><div class="">On 18 Sep 2017, at 22:47, Rainer Hoerbe <<a href="mailto:rainer@hoerbe.at" class="">rainer@hoerbe.at</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div class="">When I try to sign with xmlsectool, it does not find the objects:<br class=""></div></div></blockquote><div><br class=""></div><div>You say that you "can list key and cert", referencing this output:</div><div><br class=""></div><div><blockquote type="cite" class=""><span style="font-family: Monaco;" class="">Private Key Object; RSA </span><br style="font-family: Monaco;" class=""><span style="font-family: Monaco;" class=""> label: test</span><br style="font-family: Monaco;" class=""><span style="font-family: Monaco;" class=""> ID: 01</span><br style="font-family: Monaco;" class=""><span style="font-family: Monaco;" class=""> Usage: decrypt, sign, unwrap</span><br style="font-family: Monaco;" class=""><span style="font-family: Monaco;" class="">Public Key Object; RSA 2048 bits</span><br style="font-family: Monaco;" class=""><span style="font-family: Monaco;" class=""> label: test</span><br style="font-family: Monaco;" class=""><span style="font-family: Monaco;" class=""> ID: 01</span><br style="font-family: Monaco;" class=""><span style="font-family: Monaco;" class=""> Usage: encrypt, verify, wrap</span></blockquote><br class=""></div><div>There is no certificate there, just the two parts of an RSA keypair (private key and public key). Here's what I see with a token that does work with XMLSecTool:</div><div><br class=""></div><div><blockquote type="cite" class=""><div style="margin: 0px; line-height: normal; font-family: 'Andale Mono'; color: rgb(77, 47, 45); background-color: rgb(223, 219, 195);" class=""><span style="font-variant-ligatures: no-common-ligatures" class="">Certificate Object, type = X.509 cert</span></div><div style="margin: 0px; line-height: normal; font-family: 'Andale Mono'; color: rgb(77, 47, 45); background-color: rgb(223, 219, 195);" class=""><span style="font-variant-ligatures: no-common-ligatures" class=""> label: key10</span></div><div style="margin: 0px; line-height: normal; font-family: 'Andale Mono'; color: rgb(77, 47, 45); background-color: rgb(223, 219, 195);" class=""><span style="font-variant-ligatures: no-common-ligatures" class=""> ID: 6b65793130</span></div><div style="margin: 0px; line-height: normal; font-family: 'Andale Mono'; color: rgb(77, 47, 45); background-color: rgb(223, 219, 195);" class=""><span style="font-variant-ligatures: no-common-ligatures" class="">Public Key Object; RSA 2048 bits</span></div><div style="margin: 0px; line-height: normal; font-family: 'Andale Mono'; color: rgb(77, 47, 45); background-color: rgb(223, 219, 195);" class=""><span style="font-variant-ligatures: no-common-ligatures" class=""> label: key10</span></div><div style="margin: 0px; line-height: normal; font-family: 'Andale Mono'; color: rgb(77, 47, 45); background-color: rgb(223, 219, 195);" class=""><span style="font-variant-ligatures: no-common-ligatures" class=""> ID: 6b65793130</span></div><div style="margin: 0px; line-height: normal; font-family: 'Andale Mono'; color: rgb(77, 47, 45); background-color: rgb(223, 219, 195);" class=""><span style="font-variant-ligatures: no-common-ligatures" class=""> Usage: encrypt, verify</span></div></blockquote></div><div><br class=""></div><div>Note that the first object is of a different kind than in your case. That may be significant.</div><div><br class=""></div><div><br class=""></div><blockquote type="cite" class=""><div class=""><div class="">ERROR XMLSecTool - Unable to recover key entry from PKCS11 store<br class="">java.security.cert.CertificateException: unknown type of key entry in keystore<br class=""><span class="Apple-tab-span" style="white-space:pre"> </span>at net.shibboleth.tool.xmlsectool.CredentialHelper.getCredentialFromKeystore(CredentialHelper.java:212) ~[xmlsectool-2.0.0.jar:na]<br class=""><span class="Apple-tab-span" style="white-space:pre"> </span>at net.shibboleth.tool.xmlsectool.CredentialHelper.getPKCS11Credential(CredentialHelper.java:179) ~[xmlsectool-2.0.0.jar:na]<br class=""><span class="Apple-tab-span" style="white-space:pre"> </span>at net.shibboleth.tool.xmlsectool.XMLSecTool.getCredential(XMLSecTool.java:901) [xmlsectool-2.0.0.jar:na]<br class=""><span class="Apple-tab-span" style="white-space:pre"> </span>at net.shibboleth.tool.xmlsectool.XMLSecTool.main(XMLSecTool.java:148) [xmlsectool-2.0.0.jar:na]<br class=""></div></div></blockquote><div><br class=""></div><div><br class=""></div><div>At this point, XMLSecTool is looking at the KeyStore.Entry corresponding to the alias you provided.</div><div><br class=""></div><div>Examining the code, though, there a are a couple of possibilities.</div><div><br class=""></div><div>One of them, unfortunately, is that no such KeyEntry was found (that would be a bug). You could try a completely different alias to see if you get the same result; if so, please file a JIRA case.</div><div><br class=""></div><div>The other possibility is that the KeyEntry was found, but it was not one of the types of KeyEntry that XMLSecTool knows how to deal with. It can handle PrivateKeyEntry and TrustedCertificateEntry. What appears in the "keystore" depends on the PKCS11 bridge and to a certain extent to the native drivers as well, so there's a lot of variation and it's possible we haven't covered one. It's also possible that this is a result of your not having a certificate object on the token after all, just a private key (which I think results in a SecretKeyEntry rather than a PrivateKeyEntry). XMLSecTool (currently) requires you to have something it can extract a certificate from.</div><div><br class=""></div><div>One thing you might try is to list the keystore entries with keytool rather than pkcs11-tool. That way you'll get a more direct indication of what the stack has turned the objects on the token into in Java keystore terms; the results of this can be surprising.</div><div><br class=""></div><div>Let me know if you can make progress based on the above. If that's not possible, I guess I'd have to put it down to "every ^*^&*^&! token is different" and ask you to consider if you might have a spare token you could mail me that I can use to try and debug this with.</div></div><div class=""><br class="webkit-block-placeholder"></div><div class="">Cheers,</div><div class=""><span class="Apple-style-span" style="border-collapse: separate; font-variant-ligatures: normal; font-variant-east-asian: normal; font-variant-position: normal; line-height: normal; border-spacing: 0px;"><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><span class="Apple-style-span" style="border-collapse: separate; color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; border-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-stroke-width: 0px;"><div class=""><br class=""></div><div class=""> -- Ian<br class=""></div><div class=""><span class="Apple-style-span" style="font-size: medium;"><br class=""></span></div></span></div></span><br class="Apple-interchange-newline"><br class="Apple-interchange-newline">
</div>
<br class=""></body></html>