OpenSAML user discussion

[Brent Putman <>]

On 3/4/10 2:19 AM, JC Estienney wrote:
> 
> 
> The signed SamlResponse indicated at the end of my message if dumped
> just before the unmarshall operation.
> After that when i get the assertion form the Response object :
> 
> XMLHelper.prettyPrintXML( (Assertion)reponseSAML.getAssertions().get(0))
>  give :


Ok, well, the full response there looked ok, and the assertion looks ok
too, as far as I can tell.


> 
> I will work to obtain then exact digest stream of then signature operation.
> It is not buid by openSaml2  but bye a third tool using C++ xmlsec API.
> 
> The verification with the same tool is ok.


That's fine.  The problem though, was this:


> [org.apache.xml.security.utils.DigesterOutputStream] <samlp:Response 
> xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" 
> xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"; 
> Destination="https://comptePS/ACS"; 
> ID="_6bf020b4-2334-11df-833b-d91e3055817a" 
> IssueInstant="2010-02-27T00:09:50Z" Version="2.0" 
> xsi:schemaLocation="urn:oasis:names:tc:SAML:2.0:assertion 
> http://docs.oasis-open.org/security/saml/v2.0/saml-schema-assertion-2.0.xsd";>
>   <saml:Issuer 
> xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">urn:interops:samu:1.0</saml:Issuer>
>   <samlp:Status>
>     <samlp:StatusCode 
> Value="urn:oasis:names:tc:SAML:2.0:status:Success"></samlp:StatusCode>
>   </samlp:Status>
> </samlp:Response> 




If this is the actual output from Apache xmlsec, and hasn't been edited,
etc., then something is wrong, because it's not including the Assertion
in the data over which it's calculating the digest.  If you're saying
that you have a trace which shows that the Response does in fact include
the Assertion, then I don't have any explanation for that.  Either
something very strange is going on with xmlsec, or there's a bug
somewhere else, maybe in how the DOM is being parsed and built.

Getting the digest stream from the signing side will be helpful in the
long run, but until you figure what's going on here with the missing
Assertion in digest calculation, it's not going to help.

--Brent