OpenSAML user discussion

[Deena Gurajala <>]

The validation I was doing is below.

            UnmarshallerFactory unmarshallerFactory = Configuration
                    .getUnmarshallerFactory();
            Unmarshaller unmarshaller = unmarshallerFactory
                    .getUnmarshaller(element);

            AuthnRequest authnReq = (AuthnRequest) unmarshaller.unmarshall(element);
            
            KeyStore ks = KeyStore.getInstance(KeyStore.getDefaultType());
            char[] password = "xxxxxx".toCharArray();
            FileInputStream fis = new FileInputStream("test.jks");
            ks.load(fis, password);
            fis.close();
            
            KeyStore.PrivateKeyEntry pkEntry = (KeyStore.PrivateKeyEntry) ks
            .getEntry("xxxxxxx", new KeyStore.PasswordProtection(
                    "keypass".toCharArray()));
            
            X509Certificate x509Certificate =(X509Certificate) pkEntry.getCertificate();
            
            Signature signature = authnReq.getSignature();

            SAMLSignatureProfileValidator profVldr = new SAMLSignatureProfileValidator();
            
            profVldr.validate(signature);
            
            BasicX509Credential credential = new BasicX509Credential();
            credential
                    .setEntityCertificate((java.security.cert.X509Certificate) x509Certificate);
            SignatureValidator sigValidator = new SignatureValidator(credential);
            
            sigValidator.validate(signature);


This is the success output.

1955 [main] INFO org.apache.xml.security.signature.Reference - Verification successful for URI "#_k7722b88" 

The reason, I am asking try this way is because, if you the code below, it auto generates the namespace. And also give some unique id for the signatures element (Assertion). I did experience this exception before. But not this one. I was trying to set some name space manually and it was throwing this error. I used the builder object, it worked fine.

Hope it works for you.

On Fri, Aug 28, 2009 at 9:31 AM, Deena Gurajala <> wrote:

Hi,

I don't you found the solution or not. Thebelow code is working for me. Everything you and I are doing the sma except the way building the signature. Please find the modified code below. I hope it works.


 
        assertion.setID("_k7722b88");

    

// This below part is same is same

         KeyStore ks = KeyStore.getInstance(KeyStore.getDefaultType());

             char[] password = "xxxxxx".toCharArray();

             FileInputStream fis = new FileInputStream("c:/keystore/test.ks");

             ks.load(fis, password);

             fis.close();

             char[] achKeyStorePass = password;

             String keyAlias = "mytestkey";

             PrivateKey pk =  (PrivateKey) ks.getKey(keyAlias,achKeyStorePass);

             X509Certificate certificate = (X509Certificate) ks.getCertificate(keyAlias);

             BasicX509Credential credential = new BasicX509Credential();

             credential.setEntityCertificate(certificate);

             credential.setPrivateKey(pk);

//Below is the difference


            SignatureBuilder signBldr=new SignatureBuilder();
            Signature signature = signBldr.buildObject();

            signature.setSigningCredential(credential);

            signature
                    .setSignatureAlgorithm(SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA1);

            signature
                    .setCanonicalizationAlgorithm(SignatureConstants.ALGO_ID_C14N_EXCL_OMIT_COMMENTS);

       assertion.setSignature(signature);

           MarshallerFactory marshallerFactory = Configuration
                    .getMarshallerFactory();
            Marshaller marshaller = marshallerFactory.getMarshaller(assertion);
            element = marshaller.marshall(assertion);
           
            Signer.signObject(assertion);

On Fri, Aug 28, 2009 at 8:40 AM, Scott Cantor <> wrote:

Ravi Balasubramanian wrote on 2009-08-28:

> Yes, it is the ID I set to assertion...

Then the xmlsec verifier doesn't know what IDs exist, which is not terribly
unusual. I suspect you're doing SAML 1 and would have to do SAML 2 to get
that online verifier to work by guessing that an attribute called ID is an
XML ID. Patently insecure, but that's common.

-- Scott