OpenSAML user discussion

[lakshmi narasimhan <>]

Hello,

 

Thanks for this suggestion. I'll try using these tools to figure out what is changing between signing and verification. In my case, we, as the service provider, have developed a java code using OpenSAML 2.0. The identity Provider on the other end, has converted the OpenSAML API into Python and is using this code to generate the assertion.

 

We have also developed a java code to generate assertion from our side too, so we can generate and test our own assertions before receiving the one sent by the identity provider.

 

As of now, we are able to validate our own assertion successfully. However, when the identity provider sends a very similar assertion which uses the same Private key as we use, the assertion fails during the signature validation step(please refer to the code snippet below). The logs for both the cases, are almost the same until the point where Signature validation happens. At this point, the logging just stops and throws a warning saying 'Signature verification failed'. 

 

 

I was wondering if there is a way to find out what is failing at this point:

 

if (!sa.verify(sigBytes)) {
log.warn("Signature verification failed.");
return false;
}

I'm not sure how to turn on additional logging for the checkSignatureValue method in XMLSignature class. Could someone please help with a suggestion? This is a bit urgent, so any quick response would be very much appreciated.

 

Thanks in Advance,

Laks.

 

On Wed, Jan 6, 2010 at 8:07 PM, Scott Cantor <> wrote:

lakshmi narasimhan wrote on 2010-01-06:

> I've been trying to figure out why this(Signature bytes comparison
> failure) is happening, but couldn't make it out yet. Could someone
> please help me out?

All that's known is what I already told you. You need to determine what's
changing between signing and verification and why.

There are numerous tools like Oxygen and online verifiers like Aleksey
Sanin's that will prove to you whether the message is actually bad and that
this isn't about the code.

Welcome to signatures.

-- Scott