mace-opensaml-users - SAML sample - walkthrough of signature verification
Subject: OpenSAML user discussion
List archive
- From:
- To:
- Subject: SAML sample - walkthrough of signature verification
- Date: Mon, 8 Oct 2007 14:48:59 -0400 (EDT)
Hi,
I am writing my own SAML parser using libxml2 and xpath expressions.
Taking as example, opensaml2's sample test data file -
http://svn.middleware.georgetown.edu/view/trunk/samltest/data/signature/SAML2Assertion.xml?root=cpp-opensaml2&revision=218&content-type=text%2Fplain&pathrev=218
here's what to do to validate it (i think) -
1. parsing and storing signature, signedinfo, signaturevalue, digestvalue
nodes.
2. doing the enveloped-transform i.e. removing the ds:signature node
(alongwith all its child nodes). so after my first transform my doc is
simply = original_doc - signature_node.
3. next, the second transform. this i'm doing by simply passing the
xml doc (after performing step 1) to xmlc14ndocmemory() call in
libxml2.
4. simply calculating the digest value of the doc from step 3. and
converting that to a base64 value. this calculated value should be
equal to the digestvalue in the doc right?
Here's the problem. For the sample file after peforming step 4, the doc is -
<saml:Assertion xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
ID="ident"
IssueInstant="1970-01-02T01:01:02.100Z"Version="2.0"><saml:Issuer>issuer</saml:Issuer>
<saml:Subject><saml:NameID>John Doe</saml:NameID></saml:Subject>
<saml:AuthnStatementAuthnInstant="1970-01-02T01:01:02.100Z"><saml:AuthnContext>
<saml:AuthnContextClassRef>method</saml:AuthnContextClassRef></saml:AuthnContext>
</saml:AuthnStatement></saml:Assertion>
now the digest value of this raw text is -
0321b00eec3184c36462b993c1a30dff6efe1023
and its base64 encode is
MDMyMWIwMGVlYzMxODRjMzY0NjJiOTkzYzFhMzBkZmY2ZWZlMTAyMw==
Where am i going wrong? The algorithm itself or any detail in the
calculation/canonicalization? It would be great if someone can show a
complete and correct such walkthrough for the sample file.
Thanks,
KK
- SAML sample - walkthrough of signature verification, krish . kumar, 10/08/2007
- RE: SAML sample - walkthrough of signature verification, Scott Cantor, 10/08/2007
Archive powered by MHonArc 2.6.16.