OpenSAML user discussion

[lakshmi narasimhan <>]

Hello all,

 

We are using OpenSAML 2.0 for creating and validating SAML assertion. When we(receiver/validator) generate the assertion on our side itself, we are able to validate the signature successfully using our OpenSAML validation code. However, when the sender sends a similar assertion to us, we are getting the following exception:

 

05-Jan-2009 20:53:11 org.apache.xml.security.signature.Reference verify
WARNING: Verification failed for URI "#afdg3vce"
org.opensaml.xml.validation.ValidationException: Signature did not validate against the credential's key
        at org.opensaml.xml.signature.SignatureValidator.validate(SignatureValidator.j­ava:78)
        at com.aviva.tam.pmi.ValidateSAML2Signature.signatureValidator(ValidateSAML2Si­gnature.java:168)
        at org.apache.jsp.service_005fprovider_jsp._jspService(service_005fprovider_js­p.java:241)
        at org.apache.jasper.runtime.HttpJspBase.service(HttpJspBase.java:70)
        at javax.servlet.http.HttpServlet.service(HttpServlet.java:803)
        at org.apache.jasper.servlet.JspServletWrapper.service(JspServletWrapper.java:­384)
        at org.apache.jasper.servlet.JspServlet.serviceJspFile(JspServlet.java:320)
        at org.apache.jasper.servlet.JspServlet.service(JspServlet.java:266)
        at javax.servlet.http.HttpServlet.service(HttpServlet.java:803)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(Applicatio­nFilterChain.java:290)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterC­hain.java:206)
        at org.netbeans.modules.web.monitor.server.MonitorFilter.doFilter(MonitorFilte­r.java:196)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(Applicatio­nFilterChain.java:235)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterC­hain.java:206)
        at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.j­ava:228)
        at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.j­ava:175)
        at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:12­8)
        at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:10­4)
        at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.jav­a:109)
        at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:216)
        at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:844)
        at org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process(Htt­p11Protocol.java:634)
        at org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:445)
        at java.lang.Thread.run(Unknown Source)

 

We are sure we are using the correct public key for validating the signature (we verified the public key successfully using the signature value and the original assertion content using OpenSSL utility). It could be that we are getting a different Digest value than what's being computed at the sender's side. However, we are not able to find out how we can turn-on logging to capture the digest value that gets computed at our end(receiving side). We would like to see the actual Digest value that gets computed as a result of Canonicalizing the message digest we receive. 

 

Can someone please guide us on how best we can achieve this and also what loggers need to be enabled? Any help would be gratefully received.

 

Thanks in advance,

Laks.