Skip to Content.
Sympa Menu

mace-opensaml-users - RE: OpenSaml2 Library - SAML11 signature validation error

Subject: OpenSAML user discussion

List archive

RE: OpenSaml2 Library - SAML11 signature validation error


Chronological Thread 
  • From: "Scott Cantor" <>
  • To: <>
  • Subject: RE: OpenSaml2 Library - SAML11 signature validation error
  • Date: Thu, 1 Feb 2007 14:10:21 -0500
  • Organization: The Ohio State University

> Ok, this had occurred to me as another way to implement. If we don't
> consider it to be a Bad Thing to modify the DOM we're unmarshalling, then
> that would be a cleaner solution. And since you're doing it in C++, I
> guess you don't. :-)

IDness is a fundamentally broken construct (it only exists with DTDs), so
you have to do lots of ugly things to make it work even half right.

> I'll have to make sure to handle the AttributeExtensible cases too, using
> the global ID registry, shouldn't be too difficult. Can probably
> centralize that in the AbstractXMLObjectUnmarshaller.

Yes, I call setIdAttributeNode in various places when unmarshalling.

One thing I'm not doing but probably need to is check the SAML version and
not do this for SAML 1.0, probably by manually examining the DOM and
checking MinorVersion.

-- Scott





Archive powered by MHonArc 2.6.16.

Top of Page