OpenSAML user discussion

[mochamaster <>]

I'm having a similar problem.  I'm able to sign okay
but verification fails. I'm doing simple=true
signature and verification.  

When I sign and immediately verify (in the same code
block just for testing purposes) with the attached
certificate, everything works.

however, verification fails once the signed data is
returned via http, deserialized into saml objects and
verified.

i'm not using soap or profiles, just straight http
with a saml payload.

--- Rakesh Aggarwal 
<>
wrote:
>  
> Hi Folks!
>  
> I am new to this group, so I apologize in advance if
> this question has
> been asked before. I could not find it in the
> archives. An earlier post
> seem to suggest that SAMLRequest object should be
> used while signing and
> verifying the assertion. But I am not sure how to
> generate assertions
> with this object. I am using SAMLAssertion object
> instead. Is that
> acceptatble?
>  
> I am using  OpenSaml toolkit version 0.8 to create
> and verify
> signed-saml-assertions.  I am running into a problem
> while trying to
> verify the signed assertion, which I created earlier
> using the same
> toolkit. Somehow the SAMLSignedObject.verify()
> method returns "failed to
> validate signature value". I am using the flag
> "simple=true" while
> signing and verifying the assertions.
>  
> Please see the attached files for the contents of
> the Assertion:
> 1)       signAssert.xml - contents of the
> SAMLAssertion after creating
> and siging it
> 2)       verifyAssert.xml - contents of the
> SAMLAssertion while
> verifying it.
>  
> The contents of the Assertion object in the above 2
> files look exactly
> the same, still the sig.checkSignatureValue(k)
> method fails while
> verifying the signature. I am using null key while
> verifying the
> signature.
>  
> Any help will be appreciated.
>  
> Thanks.
>  
> -Rakesh
>  
> -
>
<file:///C:\Documents%20and%20Settings\raggarwal\Local%20Settings\Tempor
> ary%20Internet%20Files\OLK173\signAssert.xml##> 
> <SIGNASSERT.XML
>  
>  
> Ass<Assertion
> xmlns="urn:oasis:names:tc:SAML:1.0:assertion"
> AssertionID="6ebc2505-0964-4642-b23c-6898ea1395c0"
> IssueInstant="2003-04-11T21:41:00Z"
> Issuer="ConfluentCORE"
> MajorVersion="1" MinorVersion="0">
>   <Conditions NotBefore="2003-04-11T21:40:58Z"
> NotOnOrAfter="2003-04-28T22:21:27Z" /> 
> -
>
<file:///C:\Documents%20and%20Settings\raggarwal\Local%20Settings\Tempor
> ary%20Internet%20Files\OLK173\signAssert.xml##>
> <AuthenticationStatement
> AuthenticationInstant="2003-04-11T21:40:58Z"
>
AuthenticationMethod="http://schemas.xmlsoap.org/ws/2002/04/secext";>
> -
>
<file:///C:\Documents%20and%20Settings\raggarwal\Local%20Settings\Tempor
> ary%20Internet%20Files\OLK173\signAssert.xml##> 
> <Subject>
>   <NameIdentifier>guest</NameIdentifier> 
>   </Subject>
>   <SubjectLocality DNSAddress="localhost"
> IPAddress="127.0.0.1" /> 
>   </AuthenticationStatement>
> -
>
<file:///C:\Documents%20and%20Settings\raggarwal\Local%20Settings\Tempor
> ary%20Internet%20Files\OLK173\signAssert.xml##> 
> <ds:Signature
> xmlns:ds="http://www.w3.org/2000/09/xmldsig#";>
> -
>
<file:///C:\Documents%20and%20Settings\raggarwal\Local%20Settings\Tempor
> ary%20Internet%20Files\OLK173\signAssert.xml##> 
> <ds:SignedInfo>
>   <ds:CanonicalizationMethod
>
Algorithm="http://www.w3.org/TR/2001/REC-xml-c14n-20010315";
> /> 
>   <ds:SignatureMethod
>
Algorithm="http://www.w3.org/2000/09/xmldsig#dsa-sha1";
> /> 
> -
>
<file:///C:\Documents%20and%20Settings\raggarwal\Local%20Settings\Tempor
> ary%20Internet%20Files\OLK173\signAssert.xml##> 
> <ds:Reference URI="">
> -
>
<file:///C:\Documents%20and%20Settings\raggarwal\Local%20Settings\Tempor
> ary%20Internet%20Files\OLK173\signAssert.xml##> 
> <ds:Transforms>
>   <ds:Transform
>
Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature";
> /> 
>   </ds:Transforms>
>   <ds:DigestMethod
> Algorithm="http://www.w3.org/2000/09/xmldsig#sha1";
> />
> 
>  
>
<ds:DigestValue>eWrawYuJVjmT7SUhxE4rV+dFNSM=</ds:DigestValue>
> 
>   </ds:Reference>
>   </ds:SignedInfo>
>  
>
<ds:SignatureValue>E4Ns8WUqVjl0sY+m7SEXgU7pka93fJf1m5JTygR98IknKAypzWpFr
> w==</ds:SignatureValue> 
> -
>
<file:///C:\Documents%20and%20Settings\raggarwal\Local%20Settings\Tempor
> ary%20Internet%20Files\OLK173\signAssert.xml##> 
> <ds:KeyInfo>
> -
>
<file:///C:\Documents%20and%20Settings\raggarwal\Local%20Settings\Tempor
> ary%20Internet%20Files\OLK173\signAssert.xml##> 
> <ds:X509Data>
>  
>
<ds:X509Certificate>MIIDDTCCAssCBD6XCikwCwYHKoZIzjgEAwUAMGwxEDAOBgNVBAYT
>
B1Vua25vd24xEDAOBgNVBAgTB1Vua25vd24xEDAOBgNVBAcTB1Vua25vd24xEDAOBgNVBAoT
>
B1Vua25vd24xEDAOBgNVBAsTB1Vua25vd24xEDAOBgNVBAMTB1Vua25vd24wHhcNMDMwNDEx
>
MTgzMjA5WhcNMDMwNzEwMTgzMjA5WjBsMRAwDgYDVQQGEwdVbmtub3duMRAwDgYDVQQIEwdV
>
bmtub3duMRAwDgYDVQQHEwdVbmtub3duMRAwDgYDVQQKEwdVbmtub3duMRAwDgYDVQQLEwdV
>
bmtub3duMRAwDgYDVQQDEwdVbmtub3duMIIBuDCCASwGByqGSM44BAEwggEfAoGBAP1/U4Ed
>
dRIpUt9KnC7s5Of2EbdSPO9EAMMeP4C2USZpRV1AIlH7WT2NWPq/xfW6MPbLm1Vs14E7gB00
>
b/JmYLdrmVClpJ+f6AR7ECLCT7up1/63xhv4O1fnxqimFQ8E+4P208UewwI1VBNaFpEy9nXz
>
rith1yrv8iIDGZ3RSAHHAhUAl2BQjxUjC8yykrmCouuEC/BYHPUCgYEA9+GghdabPd7LvKtc
>
NrhXuXmUr7v6OuqC+VdMCz0HgmdRWVeOutRZT+ZxBxCBgLRJFnEj6EwoFhO3zwkyjMim4TwW
>
eotUfI0o4KOuHiuzpnWRbqN/C/ohNWLx+2J6ASQ7zKTxvqhRkImog9/hWuWfBpKLZl6Ae1Ul
>
ZAFMO/7PSSoDgYUAAoGBAObp73ptixFfnblFzmfSoffuRTv9+cA9hDCNfuefIBd562HfbfoK
>
yGqIPH7I16kZrCgiWyaW/nWN3+xCfk9WFX4r0ViWGbTqidgU94srcyAPw7LXOBVttJ7soYkc
>
DV+0soh6DhU35FEGEyX8Sfj4lSrwM+maEkjI3A0O6zsbwZtmMAsGByqGSM44BAMFAAMvADAs
>
AhRUhjM+WR2hUBcVige3UJtkVYMkFwIUEF25GT6c+vjj23Uu3ybRoW3Enq0=</ds:X509Cer
> tificate> 
>   </ds:X509Data>
>   </ds:KeyInfo>
>   </ds:Signature>
>   </Assertion>
>  
>  
> VERIFYASSERT.XML
>  
>  
>  
> -
>
<file:///C:\Documents%20and%20Settings\raggarwal\Local%20Settings\Tempor
> ary%20Internet%20Files\OLK173\verifyAssert.xml##> 
> <Assertion
> xmlns="urn:oasis:names:tc:SAML:1.0:assertion"
> AssertionID="6ebc2505-0964-4642-b23c-6898ea1395c0"
> IssueInstant="2003-04-11T21:41:00Z"
> Issuer="ConfluentCORE"
> MajorVersion="1" MinorVersion="0">
>   <Conditions NotBefore="2003-04-11T21:40:58Z"
> NotOnOrAfter="2003-04-28T22:21:27Z" /> 
> -
>
<file:///C:\Documents%20and%20Settings\raggarwal\Local%20Settings\Tempor
> ary%20Internet%20Files\OLK173\verifyAssert.xml##>
> <AuthenticationStatement
> AuthenticationInstant="2003-04-11T21:40:58Z"
>
AuthenticationMethod="http://schemas.xmlsoap.org/ws/2002/04/secext";>
> -
>
<file:///C:\Documents%20and%20Settings\raggarwal\Local%20Settings\Tempor
> ary%20Internet%20Files\OLK173\verifyAssert.xml##> 
> <Subject>
>   <NameIdentifier>guest</NameIdentifier> 
>   </Subject>
>   <SubjectLocality DNSAddress="localhost"
> IPAddress="127.0.0.1" /> 
>   </AuthenticationStatement>
> -
>
<file:///C:\Documents%20and%20Settings\raggarwal\Local%20Settings\Tempor
> ary%20Internet%20Files\OLK173\verifyAssert.xml##> 
> <ds:Signature
> xmlns:ds="http://www.w3.org/2000/09/xmldsig#";>
> -
>
<file:///C:\Documents%20and%20Settings\raggarwal\Local%20Settings\Tempor
> ary%20Internet%20Files\OLK173\verifyAssert.xml##> 
> <ds:SignedInfo>
>   <ds:CanonicalizationMethod
>
Algorithm="http://www.w3.org/TR/2001/REC-xml-c14n-20010315";
> /> 
>   <ds:SignatureMethod
>
Algorithm="http://www.w3.org/2000/09/xmldsig#dsa-sha1";
> /> 
> -
>
<file:///C:\Documents%20and%20Settings\raggarwal\Local%20Settings\Tempor
> ary%20Internet%20Files\OLK173\verifyAssert.xml##> 
> <ds:Reference URI="">
> -
>
<file:///C:\Documents%20and%20Settings\raggarwal\Local%20Settings\Tempor
> ary%20Internet%20Files\OLK173\verifyAssert.xml##> 
> <ds:Transforms>
>   <ds:Transform
>
Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature";
> /> 
>   </ds:Transforms>
>   <ds:DigestMethod
> Algorithm="http://www.w3.org/2000/09/xmldsig#sha1";
> />
> 
>  
>
<ds:DigestValue>eWrawYuJVjmT7SUhxE4rV+dFNSM=</ds:DigestValue>
> 
>   </ds:Reference>
>   </ds:SignedInfo>
>  
>
<ds:SignatureValue>E4Ns8WUqVjl0sY+m7SEXgU7pka93fJf1m5JTygR98IknKAypzWpFr
> w==</ds:SignatureValue> 
> -
>
<file:///C:\Documents%20and%20Settings\raggarwal\Local%20Settings\Tempor
> ary%20Internet%20Files\OLK173\verifyAssert.xml##> 
> <ds:KeyInfo>
> -
>
<file:///C:\Documents%20and%20Settings\raggarwal\Local%20Settings\Tempor
> ary%20Internet%20Files\OLK173\verifyAssert.xml##> 
> <ds:X509Data>
>  
>
<ds:X509Certificate>MIIDDTCCAssCBD6XCikwCwYHKoZIzjgEAwUAMGwxEDAOBgNVBAYT
>
B1Vua25vd24xEDAOBgNVBAgTB1Vua25vd24xEDAOBgNVBAcTB1Vua25vd24xEDAOBgNVBAoT
>
B1Vua25vd24xEDAOBgNVBAsTB1Vua25vd24xEDAOBgNVBAMTB1Vua25vd24wHhcNMDMwNDEx
>
MTgzMjA5WhcNMDMwNzEwMTgzMjA5WjBsMRAwDgYDVQQGEwdVbmtub3duMRAwDgYDVQQIEwdV
>
bmtub3duMRAwDgYDVQQHEwdVbmtub3duMRAwDgYDVQQKEwdVbmtub3duMRAwDgYDVQQLEwdV
>
bmtub3duMRAwDgYDVQQDEwdVbmtub3duMIIBuDCCASwGByqGSM44BAEwggEfAoGBAP1/U4Ed
>
dRIpUt9KnC7s5Of2EbdSPO9EAMMeP4C2USZpRV1AIlH7WT2NWPq/xfW6MPbLm1Vs14E7gB00
>
b/JmYLdrmVClpJ+f6AR7ECLCT7up1/63xhv4O1fnxqimFQ8E+4P208UewwI1VBNaFpEy9nXz
>
rith1yrv8iIDGZ3RSAHHAhUAl2BQjxUjC8yykrmCouuEC/BYHPUCgYEA9+GghdabPd7LvKtc
>
NrhXuXmUr7v6OuqC+VdMCz0HgmdRWVeOutRZT+ZxBxCBgLRJFnEj6EwoFhO3zwkyjMim4TwW
>
eotUfI0o4KOuHiuzpnWRbqN/C/ohNWLx+2J6ASQ7zKTxvqhRkImog9/hWuWfBpKLZl6Ae1Ul
>
ZAFMO/7PSSoDgYUAAoGBAObp73ptixFfnblFzmfSoffuRTv9+cA9hDCNfuefIBd562HfbfoK
>
yGqIPH7I16kZrCgiWyaW/nWN3+xCfk9WFX4r0ViWGbTqidgU94srcyAPw7LXOBVttJ7soYkc
>
DV+0soh6DhU35FEGEyX8Sfj4lSrwM+maEkjI3A0O6zsbwZtmMAsGByqGSM44BAMFAAMvADAs
>
AhRUhjM+WR2hUBcVige3UJtkVYMkFwIUEF25GT6c+vjj23Uu3ybRoW3Enq0=</ds:X509Cer
> tificate> 
>   </ds:X509Data>
>   </ds:KeyInfo>
>   </ds:Signature>
>   </Assertion>
>  
>  
> > <Assertion
> xmlns="urn:oasis:names:tc:SAML:1.0:assertion"
> AssertionID="6ebc2505-0964-4642-b23c-6898ea1395c0"
> IssueInstant="2003-04-11T21:41:00Z"
> Issuer="ConfluentCORE" MajorVersion="1"
> MinorVersion="0"><Conditions
> NotBefore="2003-04-11T21:40:58Z"
>
NotOnOrAfter="2003-04-28T22:21:27Z"></Conditions><AuthenticationStatement
> AuthenticationInstant="2003-04-11T21:40:58Z"
>
AuthenticationMethod="http://schemas.xmlsoap.org/ws/2002/04/secext";><Subject><NameIdentifier>guest</NameIdentifier></Subject><SubjectLocality
> DNSAddress="localhost"
>
IPAddress="127.0.0.1"></SubjectLocality></AuthenticationStatement><ds:Signature
> xmlns:ds="http://www.w3.org/2000/09/xmldsig#";>
> <ds:SignedInfo>
> <ds:CanonicalizationMethod
>
Algorithm="http://www.w3.org/TR/2001/REC-xml-c14n-20010315";></ds:CanonicalizationMethod>
> <ds:SignatureMethod
>
Algorithm="http://www.w3.org/2000/09/xmldsig#dsa-sha1";></ds:SignatureMethod>
> <ds:Reference URI="">
> <ds:Transforms>
> <ds:Transform
>
Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature";>
> </ds:Transform>
> </ds:Transforms>
> <ds:DigestMethod
>
Algorithm="http://www.w3.org/2000/09/xmldsig#sha1";></ds:DigestMethod>
>
<ds:DigestValue>eWrawYuJVjmT7SUhxE4rV+dFNSM=</ds:DigestValue>
> </ds:Reference>
> </ds:SignedInfo>
>
<ds:SignatureValue>E4Ns8WUqVjl0sY+m7SEXgU7pka93fJf1m5JTygR98IknKAypzWpFrw==</ds:SignatureValue>
> <ds:KeyInfo>
> <ds:X509Data>
> <ds:X509Certificate>
>
MIIDDTCCAssCBD6XCikwCwYHKoZIzjgEAwUAMGwxEDAOBgNVBAYTB1Vua25vd24xEDAOBgNVBAgTB1Vua25vd24xEDAOBgNVBAcTB1Vua25vd24xEDAOBgNVBAoTB1Vua25vd24xEDAOBgNVBAsTB1Vua25vd24xEDAOBgNVBAMTB1Vua25vd24wHhcNMDMwNDExMTgzMjA5WhcNMDMwNzEwMTgzMjA5WjBsMRAwDgYDVQQGEwdVbmtub3duMRAwDgYDVQQIEwdVbmtub3duMRAwDgYDVQQHEwdVbmtub3duMRAwDgYDVQQKEwdVbmtub3duMRAwDgYDVQQLEwdVbmtub3duMRAwDgYDVQQDEwdVbmtub3duMIIBuDCCASwGByqGSM44BAEwggEfAoGBAP1/U4EddRIpUt9KnC7s5Of2EbdSPO9EAMMeP4C2USZpRV1AIlH7WT2NWPq/xfW6MPbLm1Vs14E7gB00b/JmYLdrmVClpJ+f6AR7ECLCT7up1/63xhv4O1fnxqimFQ8E+4P208UewwI1VBNaFpEy9nXzrith1yrv8iIDGZ3RSAHHAhUAl2BQjxUjC8yykrmCouuEC/BYHPUCgYEA9+GghdabPd7LvKtcNrhXuXmUr7v6OuqC+VdMCz0HgmdRWVeOutRZT+ZxBxCBgLRJFnEj6EwoFhO3zwkyjMim4TwWeotUfI0o4KOuHiuzpnWRbqN/C/ohNWLx+2J6ASQ7zKTxvqhRkImog9/hWuWfBpKLZl6Ae1UlZAFMO/7PSSoDgYUAAoGBAObp73ptixFfnblFzmfSoffuRTv9+cA9hDCNfuefIBd562HfbfoKyGqIPH7I16kZrCgiWyaW/nWN3+xCfk9WFX4r0ViWGbTqidgU94srcyAPw7LXOBVttJ7soYkcDV+0soh6DhU35FEGEyX8Sfj4lSrwM+maEkjI3A0O6zsbwZtmMAsGByqGSM44BAMFAAMvADAsAhRUhjM+WR2hUBcVige3UJtkVYMkFwIUEF25GT6c+vjj23Uu3ybRoW3Enq0=
> </ds:X509Certificate>
> </ds:X509Data>
> </ds:KeyInfo></ds:Signature></Assertion>> <Assertion
> xmlns="urn:oasis:names:tc:SAML:1.0:assertion"
> AssertionID="6ebc2505-0964-4642-b23c-6898ea1395c0"
> IssueInstant="2003-04-11T21:41:00Z"
> Issuer="ConfluentCORE" MajorVersion="1"
> MinorVersion="0">
>    <Conditions NotBefore="2003-04-11T21:40:58Z"
> NotOnOrAfter="2003-04-28T22:21:27Z"></Conditions>
>    <AuthenticationStatement
> AuthenticationInstant="2003-04-11T21:40:58Z"
>
AuthenticationMethod="http://schemas.xmlsoap.org/ws/2002/04/secext";>
>     <Subject>
>      <NameIdentifier>guest</NameIdentifier>
>     </Subject>
>     <SubjectLocality DNSAddress="localhost"
> IPAddress="127.0.0.1"></SubjectLocality>
>    </AuthenticationStatement>
>    <ds:Signature
> xmlns:ds="http://www.w3.org/2000/09/xmldsig#";>
>    <ds:SignedInfo>
>    <ds:CanonicalizationMethod
>
Algorithm="http://www.w3.org/TR/2001/REC-xml-c14n-20010315";></ds:CanonicalizationMethod>
> 
>    <ds:SignatureMethod
>
Algorithm="http://www.w3.org/2000/09/xmldsig#dsa-sha1";></ds:SignatureMethod>
> 
>    <ds:Reference URI="">
>    <ds:Transforms>
>    <ds:Transform
>
Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature";></ds:Transform>
> 
> </ds:Transforms>
> 
>    <ds:DigestMethod
>
Algorithm="http://www.w3.org/2000/09/xmldsig#sha1";></ds:DigestMethod>
> 
>   
>
<ds:DigestValue>eWrawYuJVjmT7SUhxE4rV+dFNSM=</ds:DigestValue>
> 
> </ds:Reference>
> 
> </ds:SignedInfo>
> 
>   
>
<ds:SignatureValue>E4Ns8WUqVjl0sY+m7SEXgU7pka93fJf1m5JTygR98IknKAypzWpFrw==</ds:SignatureValue>
> 
>    <ds:KeyInfo>
>    <ds:X509Data>
>    <ds:X509Certificate>
>
MIIDDTCCAssCBD6XCikwCwYHKoZIzjgEAwUAMGwxEDAOBgNVBAYTB1Vua25vd24xEDAOBgNVBAgTB1Vua25vd24xEDAOBgNVBAcTB1Vua25vd24xEDAOBgNVBAoTB1Vua25vd24xEDAOBgNVBAsTB1Vua25vd24xEDAOBgNVBAMTB1Vua25vd24wHhcNMDMwNDExMTgzMjA5WhcNMDMwNzEwMTgzMjA5WjBsMRAwDgYDVQQGEwdVbmtub3duMRAwDgYDVQQIEwdVbmtub3duMRAwDgYDVQQHEwdVbmtub3duMRAwDgYDVQQKEwdVbmtub3duMRAwDgYDVQQLEwdVbmtub3duMRAwDgYDVQQDEwdVbmtub3duMIIBuDCCASwGByqGSM44BAEwggEfAoGBAP1/U4EddRIpUt9KnC7s5Of2EbdSPO9EAMMeP4C2USZpRV1AIlH7WT2NWPq/xfW6MPbLm1Vs14E7gB00b/JmYLdrmVClpJ+f6AR7ECLCT7up1/63xhv4O1fnxqimFQ8E+4P208UewwI1VBNaFpEy9nXzrith1yrv8iIDGZ3RSAHHAhUAl2BQjxUjC8yykrmCouuEC/BYHPUCgYEA9+GghdabPd7LvKtcNrhXuXmUr7v6OuqC+VdMCz0HgmdRWVeOutRZT+ZxBxCBgLRJFnEj6EwoFhO3zwkyjMim4TwWeotUfI0o4KOuHiuzpnWRbqN/C/ohNWLx+2J6ASQ7zKTxvqhRkImog9/hWuWfBpKLZl6Ae1UlZAFMO/7PSSoDgYUAAoGBAObp73ptixFfnblFzmfSoffuRTv9+cA9hDCNfuefIBd562HfbfoKyGqIPH7I16kZrCgiWyaW/nWN3+xCfk9WFX4r0ViWGbTqidgU94srcyAPw7LXOBVttJ7soYkcDV+0soh6DhU35FEGEyX8Sfj4lSrwM+maEkjI3A0O6zsbwZtmMAsGByqGSM44BAMFAAMvADAsAhRUhjM+WR2hUBcVige3UJtkVYMkFwIUEF25GT6c+vjj23Uu3ybRoW3Enq0=
> </ds:X509Certificate>
> 
> </ds:X509Data>
> 
> </ds:KeyInfo>
>   </ds:Signature>
>  </Assertion>


__________________________________________________
Do you Yahoo!?
Yahoo! Tax Center - File online, calculators, forms, and more
http://tax.yahoo.com

---------------------------------------------------mace-opensaml-users-+
For list utilities, archives, subscribe, unsubscribe, etc. please visit the
ListProc web interface at 

    http://archives.internet2.edu/

---------------------------------------------------mace-opensaml-users--