Re: Browser Post - ConsumeResponse query
David Waite <[email protected]> Thu, 14 Apr 2005 10:52:12 -0600
| Newsgroups | gmane.comp.sourceid.sso.user |
|---|---|
| Message-ID | <[email protected]> |
--===============0424903128== Content-Type: multipart/alternative; boundary=Apple-Mail-5--101137603 --Apple-Mail-5--101137603 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=WINDOWS-1252; delsp=yes; format=flowed On Apr 14, 2005, at 3:20 AM, killian davies wrote: > Hi, > > I have been using the .NET implementation. > > I have had a problem with the following the "ConsumeResponse" =20 > method of the AutnRequestor class (using browser post). > > The validation of the signature in the response (authentication =20 > response) was always returning true because "response_doc=20 > ["Signature", SignedXml.XmlDsigNamespaceUrl]" was always returning =20 > null - the XPath expr wasn't matching it. > > I changed to use the XmlNamespaceManager with all relevant =20 > namespaces added and this does now locate the Signature element. I'll look into this - thanks! Could you possibly send me an example =20 of the document, because I do not understand the circumstance at =20 which this is supposed to fail. The XPath expression below is =20 incorrect, because the location of the Signature within the response =20 document is meant to trigger different processing logic. > It is currently attempting to verify the sig but I'm always getting =20= > false back (possibly because i have updated my project to use WSE2 =20 > (bad idea - not b'ward compatible with WSE1) =96 am not sure that =20 > this is the reason?) WSE 2 at some point forked all of the System.Security.Cryptography =20 classes and interfaces - before it just had forked versions of =20 the .Xml and .X509 classes. This means you either go completely with =20 the WSE 2 version of the security classes, or you stay away =20 completely. We are wrapping up a new release now which still uses WSE =20= 1, but I imagine any release following will be against the .Net =20 Framework 2.0, and will cut the dependancies on WSE and the Mentalis =20 library. --Apple-Mail-5--101137603 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=WINDOWS-1252 <HTML><BODY style=3D"word-wrap: break-word; -khtml-nbsp-mode: space; = -khtml-line-break: after-white-space; "><BR><DIV><DIV>On Apr 14, 2005, = at 3:20 AM, killian davies wrote:</DIV><BR = class=3D"Apple-interchange-newline"><BLOCKQUOTE type=3D"cite"> <DIV = class=3D"Section1"><P class=3D"MsoNormal" = style=3D"mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><FONT = size=3D"3" face=3D"Times New Roman"><SPAN = style=3D"font-size:12.0pt">Hi,<O:P></O:P></SPAN></FONT></P><P = class=3D"MsoNormal" = style=3D"mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><FONT = size=3D"3" face=3D"Times New Roman"><SPAN style=3D"font-size:12.0pt">I = have been using the .NET implementation.<O:P></O:P></SPAN></FONT></P><P = class=3D"MsoNormal" = style=3D"mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><FONT = size=3D"3" face=3D"Times New Roman"><SPAN style=3D"font-size:12.0pt">I = have had a problem with the following the "ConsumeResponse" method of = the AutnRequestor class (using browser = post).<O:P></O:P></SPAN></FONT></P><P class=3D"MsoNormal" = style=3D"mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><FONT = size=3D"3" face=3D"Times New Roman"><SPAN style=3D"font-size:12.0pt">The = validation of the signature in the response (authentication response) = was always returning true because "<FONT color=3D"green"><SPAN = style=3D"color:green">response_doc["Signature", = SignedXml.XmlDsigNamespaceUrl]" was always returning null - the XPath = expr wasn't matching it.</SPAN></FONT><O:P></O:P></SPAN></FONT></P><P = class=3D"MsoNormal" = style=3D"mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><FONT = size=3D"3" color=3D"green" face=3D"Times New Roman"><SPAN = style=3D"font-size:12.0pt; color:green">I changed to use the = XmlNamespaceManager=A0with=A0all relevant=A0namespaces added and this = does now=A0locate=A0the Signature = element.</SPAN></FONT></P></DIV></BLOCKQUOTE>I'll look into this - = thanks! Could you possibly send me an example of the document, because I = do not understand the circumstance at which this is supposed to fail. = The XPath expression below is incorrect, because the location of the = Signature within the response document is meant to trigger different = processing logic.<BR><BLOCKQUOTE type=3D"cite"><DIV class=3D"Section1"><P = class=3D"MsoNormal" = style=3D"mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><O:P></O:P></= P><P class=3D"MsoNormal" = style=3D"mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><FONT = size=3D"3" color=3D"green" face=3D"Times New Roman"><SPAN = style=3D"font-size:12.0pt; color:green">It is currently attempting to = verify the sig but I'm always getting false back (possibly because i = have updated my project to use WSE2 (bad idea - not b'ward compatible = with WSE1) =96 am not sure that this is the = reason?)</SPAN></FONT></P></DIV></BLOCKQUOTE>WSE 2 at some point forked = all of the System.Security.Cryptography classes and interfaces - before = it just had forked versions of the .Xml and .X509 classes. This means = you either go completely with the WSE 2 version of the security classes, = or you stay away completely. We are wrapping up a new release now which = still uses WSE 1, but I imagine any release following will be against = the .Net Framework 2.0, and will cut the dependancies on WSE and the = Mentalis library.<BLOCKQUOTE type=3D"cite"><DIV class=3D"Section1"><FONT = class=3D"Apple-style-span" color=3D"#008000" face=3D"Times New Roman" = size=3D"4"><SPAN class=3D"Apple-style-span" style=3D"font-size: = 16px;"></SPAN></FONT></DIV></BLOCKQUOTE></DIV></BODY></HTML>= --Apple-Mail-5--101137603-- --===============0424903128== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ sso-users mailing list [email protected] http://lists.sourceid.org/mailman/listinfo/sso-users --===============0424903128==--