<div dir="ltr"><div>Hi,</div><div><br></div><div>

<p>I implemented a Java app, "AttributeQueryGenerator.java", that constructs a signed AttributeQuery request, a while ago, and, recently, have been trying to test it with a Shibboleth 5.1.4 IdP, with AttributeQuery enable.  The Java app uses OpenSAML 4.<br><br>It took awhile to get the certs and keys all setup and matched, and I've been able to get test AttributeQuery requests to get processed by the Shibboleth, to the point that Shibboleth attempts to validate the signature, but so far, I have not been able to get the validation working.  <br><br>When I send a request, I gat a SAML response with "RequestDenied",  and, in the idp-process.log file, I get messages that say:</p><p>WARN  org.apache.xml.security.signature.XMLSignature - Signature verification failed.<br>org.opensaml.xmlsec.signature.support.SignatureException:<br>  Signature cryptographic validation not successful</p><h3>Environment</h3>
<ul><li>
<p>Shibboleth IdP: 5.1.4</p>
</li><li>
<p>Profile: SAML2 SOAP AttributeQuery</p>
</li><li>
<p>Custom Java client using OpenSAML 4</p>
</li><li>
<p>Signing algorithm: RSA-SHA256</p>
</li><li>
<p>Digest algorithm: SHA-256</p>
</li><li>
<p>Canonicalization: Exclusive C14N (omit comments)</p>
</li><li>
<p>Client certificate also used for mTLS</p>
</li></ul>
<h3>What Is Working</h3>
<ul><li>
<p>mTLS succeeds (client cert matches metadata and TLS handshake is successful).</p>
</li><li>
<p>Metadata for the requester entity is loaded correctly (from logs)</p>
</li><li>
<p>The IdP resolves the correct SPSSODescriptor and KeyDescriptor from metadata (from logs)</p>
</li><li>
<p>The certificate embedded in request KeyInfo file matches the metadata certificate (fingerprint and modulus confirmed).</p>
</li><li>
<p>At runtime, the private key modulus matches the certificate modulus (from logs)</p>
</li><li>
<p>Local verification inside the generator using Apache Santuario’s <code>XMLSignature.checkSignatureValue(cert)</code> returns <strong>true</strong>.</p></li><li><p>If I enable the " p:ignoreRequestSignatures="true"" parameter  in the relying-party.xml, the requests process successfully, and Shibboleth sends a SAML response with an AttributeStatement with Attribute and AtttibuteValues (!).</p>
</li></ul>
<h3>What Is Failing</h3>
<p>The IdP logs show:</p>
<pre class="gmail-overflow-visible! gmail-px-0!"><div class="gmail-contain-inline-size gmail-rounded-2xl gmail-corner-superellipse/1.1 gmail-relative gmail-bg-token-sidebar-surface-primary"><div class="gmail-sticky gmail-top-[calc(var(--sticky-padding-top)+9*var(--spacing))]"><div class="gmail-absolute end-0 gmail-bottom-0 gmail-flex gmail-h-9 gmail-items-center gmail-pe-2"><div class="gmail-bg-token-bg-elevated-secondary gmail-text-token-text-secondary gmail-flex gmail-items-center gmail-gap-4 gmail-rounded-sm gmail-px-2 gmail-font-sans gmail-text-xs"></div></div></div><div class="gmail-overflow-y-auto gmail-p-4" dir="ltr"><code class="gmail-whitespace-pre!"><span><span><span class="gmail-hljs-variable">WARN</span></span><span>  </span><span><span class="gmail-hljs-variable">org</span></span><span><span class="gmail-hljs-operator">.</span></span><span><span class="gmail-hljs-variable">apache</span></span><span><span class="gmail-hljs-operator">.</span></span><span><span class="gmail-hljs-variable">xml</span></span><span><span class="gmail-hljs-operator">.</span></span><span><span class="gmail-hljs-variable">security</span></span><span><span class="gmail-hljs-operator">.</span></span><span><span class="gmail-hljs-variable">signature</span></span><span><span class="gmail-hljs-operator">.</span></span><span><span class="gmail-hljs-variable">XMLSignature</span></span><span> </span><span><span class="gmail-hljs-operator">-</span></span><span> </span><span><span class="gmail-hljs-built_in">Signature</span></span><span> </span><span><span class="gmail-hljs-variable">verification</span></span><span> </span><span><span class="gmail-hljs-variable">failed</span></span><span><span class="gmail-hljs-operator">.</span></span><span>
</span><span><span class="gmail-hljs-variable">org</span></span><span><span class="gmail-hljs-operator">.</span></span><span><span class="gmail-hljs-variable">opensaml</span></span><span><span class="gmail-hljs-operator">.</span></span><span><span class="gmail-hljs-variable">xmlsec</span></span><span><span class="gmail-hljs-operator">.</span></span><span><span class="gmail-hljs-variable">signature</span></span><span><span class="gmail-hljs-operator">.</span></span><span><span class="gmail-hljs-variable">support</span></span><span><span class="gmail-hljs-operator">.</span></span><span><span class="gmail-hljs-variable">SignatureException</span></span><span><span class="gmail-hljs-operator">:</span></span><span>
  </span><span><span class="gmail-hljs-built_in">Signature</span></span><span> </span><span><span class="gmail-hljs-variable">cryptographic</span></span><span> </span><span><span class="gmail-hljs-variable">validation</span></span><span> </span><span><span class="gmail-hljs-variable">not</span></span><span> </span><span><span class="gmail-hljs-variable">successful</span></span><span>
</span></span></code></div></div></pre>
<p>This occurs after metadata credential resolution has succeeded, and the correct signing credential is selected.</p>
<p>The response returned by the IdP is:</p>
<pre class="gmail-overflow-visible! gmail-px-0!"><div class="gmail-contain-inline-size gmail-rounded-2xl gmail-corner-superellipse/1.1 gmail-relative gmail-bg-token-sidebar-surface-primary"><div class="gmail-sticky gmail-top-[calc(var(--sticky-padding-top)+9*var(--spacing))]"><div class="gmail-absolute end-0 gmail-bottom-0 gmail-flex gmail-h-9 gmail-items-center gmail-pe-2"><div class="gmail-bg-token-bg-elevated-secondary gmail-text-token-text-secondary gmail-flex gmail-items-center gmail-gap-4 gmail-rounded-sm gmail-px-2 gmail-font-sans gmail-text-xs"></div></div></div><div class="gmail-overflow-y-auto gmail-p-4" dir="ltr"><code class="gmail-whitespace-pre!"><span><span><span class="gmail-hljs-attr">StatusCode</span></span><span>=Requester
</span><span><span class="gmail-hljs-attr">StatusCode</span></span><span>=RequestDenied
</span></span></code></div></div></pre>
<h3>Comments</h3>
<p>As mentioned, I've checked the certs/keys and matched thumbprints, multiple times, actually, so while I am not 100% sure, I thinkt the failure most probably are due to crypto-related problems </p>
<ul><li>
<p>Metadata lookup succeeds.</p>
</li><li>
<p>A credential is resolved.</p>
</li><li>
<p>Signature algorithm is accepted.</p>
</li><li>
<p>From logs, the verification seems to be failing during RSA cryptographic validation.</p>
</li></ul>
<p>This suggests either:</p>
<ol><li>
<p>The data being signed differ from the data being verified (canonicalization / DOM mutation issue), or</p>
</li><li>
<p>There is something incorrect about ID attribute handling or reference URI resolution.</p>
</li></ol>
<h3>Generator Structure</h3>
<p>In the current implementation:</p>
<ol><li>
<p>SOAP Envelope DOM is built first.</p>
</li><li>
<p>AttributeQuery is marshalled directly into the SOAP Body.</p>
</li><li>
<p><code>queryElement.setIdAttributeNS(null, "ID", true)</code> is called.</p>
</li><li>
<p><code>Signer.signObject(signature)</code> is called.</p>
</li><li>
<p>No DOM moves occur after signing (as far as I have been able to observe)</p>
</li><li>
<p>The request/document is serialized without pretty-printing.</p>
</li></ol>
<h3>Questions</h3>
<ol><li>
<p>Are there additional logging categories (in logback) that might help visibility of:</p>
<ul><li>
<p>Calculated vs expected digest values?</p>
</li><li>
<p>Reference URI resolution details?</p>
</li><li>
<p>Canonicalized SignedInfo output?</p>
</li></ul>
</li><li>
<p>Is there a recommended way within Shibboleth to dump canonicalized content used during signature verification?</p>
</li><li>
<p>Are there known problems/gotchas specific to:</p>
<ul><li>
<p>SOAP AttributeQuery signing</p>
</li><li>
<p>ID attribute registration in OpenSAML 4</p>
</li><li>
<p>Exclusive C14N handling in mixed SOAP + SAML DOM trees?</p>
</li></ul>
</li></ol>
<p>Any suggestions on any additional debugging techniques that Shibboleth IdP can provide, or any other advice or suggestions, would be GREATLY appreciated, because lately I have spent a ton of time trying to get past the validation :(!!<br><br></p><p>Thanks in advance!!<br></p><p>Jim</p><p></p>

<br></div></div>