OpenSAML user discussion

["Scott Cantor" <>]

> I have been using JAXB and XML DSIG API for signature generation and 
> verification without any issues for about a year in [1]

Are you signing base64 content? If so, does the JAXB layer actually do
schema validation and normalization, or does it just sort of generate code
that detects when the XML is out of sequence as opposed to actually
processing it as a validating parser?

The major issue is that schema normalization breaks signatures if the
SignedInfo includes base64 content. It's not a case of whether it works or
not. It simply can't, the spec doesn't permit it. You need a custom
transform, and with SAML that's not possible.

-- Scott