Shibboleth Developers

[Chad La Joie <>]

Well, something isn't reading the XML as UTF-8 encoded then.  You'll
need to refer to the docs for the APIs you're using in order to properly
parse the XML.

Adam Lantos wrote:
> Chad,
> 
> I also noticed that question marks are inserted into the
> AttributeStatement, here:
> 
> <saml:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema";
> xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance";
> xsi:type="xs:string">Lantos ?d?m</saml:AttributeValue>
> 
> These characters should be 'Ádám'... Maybe there are some character
> encoding issues here :s
> 
> Now when I set includeAttributeStatement="false" - voilá! The xml
> passes signature validation.
> 
> https://papigw.aai.niif.hu/saml2interop/samlresp-without-attributes.xml
> 
> 
> thanks,
>  Adam
> 
> 
> 
> On Wed, Oct 29, 2008 at 2:32 PM, Chad La Joie 
> <>
>  wrote:
>> The vast majority of the time (in fact, every time that I can remember)
>> that this has been a problem it has been because something on the
>> receiving side was doing something to screw up the XML before signature
>> validation occurred.  That an online verifier can't verify the signature
>> is not surprising, what you included as an attachment is NOT what the
>> IdP sends to the SP (the IdP doesn't pretty print things in order to
>> send them to the SP).
>>
>> So, we're not trying to pass the buck when we say this, but if some one
>> else's DSIG implementation is not able to validate the signature you
>> need to take it up with them.  With all the work Scott has done ensuring
>> that both the C++ and Java signature support is sound we feel pretty
>> confident now saying that if there is a problem is the other people's code.
>>
>> Adam Lantos wrote:
>>> Hello,
>>>
>>> I am facing a problem with our Shib2.0 IdP using the HTTP-POST profile
>>> and xml signatures.
>>>
>>> When the IdP issues the AuthnResponse, it signes the response using
>>> the credentials set in the relying party configuration file.
>>> Shibboleth SPs are accepting this digital signature, but the Sun
>>> JSR-105 implementation in JavaSE6 and the old proprietary Sun xml dsig
>>> implementation both reject the XML signature as 'invalid'. I have
>>> tried to use Sun's OpenSSO as SP with Shib2 IdP, but this signature
>>> error stopped me.
>>>
>>> I found an online xmldsig verifier
>>> (http://www.aleksey.com/xmlsec/xmldsig-verifier.html), but it also
>>> could not validate my response.
>>>
>>> I also tried with a different IdP deployment, but it still gives me
>>> wrong signatures. Do you have any clue what went wrong? I have
>>> attached the reponse from the idp protocol_message log.
>>>
>>>
>>> Shibboleth IdP 2.0, Sun's Java 1.5.0_16, Tomcat5.5. IdP is running
>>> fine apart from this issue.
>>>
>>>
>>> Thanks,
>>>  Adam
>> --
>> SWITCH
>> Serving Swiss Universities
>> --------------------------
>> Chad La Joie, Software Engineer, Net Services
>> Werdstrasse 2, P.O. Box, 8021 Zürich, Switzerland
>> phone +41 44 268 15 75, fax +41 44 268 15 68
>> ,
>>  http://www.switch.ch
>>
>>

-- 
SWITCH
Serving Swiss Universities
--------------------------
Chad La Joie, Software Engineer, Net Services
Werdstrasse 2, P.O. Box, 8021 Zürich, Switzerland
phone +41 44 268 15 75, fax +41 44 268 15 68
,
 http://www.switch.ch