<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<p><br>
</p>
<div class="moz-cite-prefix">On 7/8/23 11:40 PM, Paul B. Henson
wrote:<br>
</div>
<blockquote type="cite"
cite="mid:CO6PR01MB75169E32256E1C39E966A814D233A@CO6PR01MB7516.prod.exchangelabs.com"><br>
<pre class="moz-quote-pre" wrap="">Yeah, assuming not a ridiculous amount of traffic at the time I can do a pretty reasonable correlation based on timestamp and source IP address; looks like this one is actually a post binding, but does include a referrer pointing out the culprit:
2023-07-08 20:30:59,331 - 10.104.223.125/node04qrx7hxnxj2xt2wc4iz4kcny110466 - WARN [org.apache.xml.security.signature.XMLSignature:883] - Signature verification failed.
10.104.223.125 - - [08/Jul/2023:20:30:59 -0700] "POST /idp/profile/SAML2/POST/SSO HTTP/1.1" 400 5414 <a class="moz-txt-link-rfc2396E" href="https://platform.boomi.com/">"https://
platform.boomi.com/"</a> "Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Firefox/102.0"
</pre>
<br>
</blockquote>
<p><br>
</p>
<p>If it's a POST binding inbound to the IdP and therefore an XML
protocol message signature, we do log this, but on DEBUG. You can
get this on DEBUG from
org.opensaml.saml.common.binding.security.impl.SAMLProtocolMessageXMLSignatureSecurityHandler.
Look for lines matching the text of this log statement. Here
"context issuer" would be the entityID of the SP.<br>
</p>
<p><font face="monospace">log.debug(<br>
"{} Validation of protocol message signature failed for
context issuer '{}', message type: {}",<br>
getLogPrefix(), contextEntityID, msgType);</font></p>
<p><br>
</p>
<p>For the archives, if it's Redirect or POST SimpleSign binding,
the corresponding logging class will be
org.opensaml.saml.common.binding.security.impl.BaseSAMLSimpleSignatureSecurityHandler,
and logs like:</p>
<p><font face="monospace">log.warn("{} Validation of request simple
signature failed for context issuer: {}", getLogPrefix(),<br>
contextEntityID);</font></p>
<p><font face="monospace">log.warn("{} Validation of request simple
signature failed for derived issuer: {}", getLogPrefix(),<br>
derivedEntityID);</font></p>
<p><br>
</p>
<p>I don't recollect why in the first case it's DEBUG and in the
latter case it's WARN. There might have been a reason that "made
sense" at the time, but I'd have to read the surrounding code
in-depth to sort it out. If we were going to change something,
we'd probably bump failures in the first case up to WARN.</p>
<p>Thanks,<br>
Brent<br>
</p>
</body>
</html>