OpenSAML user discussion

["Scott Cantor" <>]

> Final question on this thread. If I open an SAML response generated
> using library with an editor like oxygen, it does not verify the
> signature. Is it a known issue?

No, it means either there's a bug or you've corrupted the XML before
verifying it. Since Oxygen uses the same underlying xmlsec code, the chances
are much greater it's the latter.

> is it related to C14n stuff.

In a manner of speaking. You've corrupted the XML and the c14n result is now
different. If you change a single byte, you lose. That is the best working
assumption, and to understand when it's not true, you need to understand
these specs very, very well. It's simpler to treat it as a given and never,
ever, ever, ever change a single byte.

-- Scott