OpenSAML user discussion

[Scott Cantor <>]

> SAMLResponse samlResponse = ...
> Iterator iter = samlResponse.getAssertions();
> SAMLAssertion samlAssertion = (SAMLAssertion)
> iter.next();
> samlAssertion.sign(..DSA..,privateKey,certs,true);
> samlAssertion.verify(true); // this works

If this works, it's a fluke and you're not signing what you think you are. 
You can't sign an assertion that's inside a response with
that simple flag because the signature will cover the whole response. And the 
non-simple mode doesn't really work most of the time.
So, the options are limited.

SAML 1.0 only uses signing on responses in the POST profile. Nothing else is 
easily supportable except other use cases where the
signed content is the only thing in the document.

Again, I suggest waiting for a new version based on SAML 1.1. This is mostly 
a hopeless exercise at this point.

I'll document whatever the state of things is when we do the next release so 
everyone knows what will and won't work.

-- Scott

---------------------------------------------------mace-opensaml-users-+
For list utilities, archives, subscribe, unsubscribe, etc. please visit the
ListProc web interface at 

    http://archives.internet2.edu/

---------------------------------------------------mace-opensaml-users--