OpenSAML user discussion

[Farrukh Najmi <>]

Scott Cantor wrote:

> > I have been using JAXB and XML DSIG API for signature generation and 
> > verification without any issues for about a year in [1]
> >    
>
> Are you signing base64 content? 
Yes

> If so, does the JAXB layer actually do
> schema validation and normalization, or does it just sort of generate code
> that detects when the XML is out of sequence as opposed to actually
> processing it as a validating parser?
>  
It can do schema validation (not sure about schema normalization) but I 
keep it turned off for performance.

> The major issue is that schema normalization breaks signatures if the
> SignedInfo includes base64 content. It's not a case of whether it works or
> not. It simply can't, the spec doesn't permit it. You need a custom
> transform, and with SAML that's not possible.
>  
I assume then that schema normalization is not being done by JAXB in teh 
mode that I am using it as I do not observe any problems.

--
Regards,
Farrukh