WSSE signature validation fails
Tomer Azran <[email protected]> Tue, 21 Aug 2018 20:24:56 +0000
| Newsgroups | gmane.text.xml.xmlsec |
|---|---|
| Message-ID | <[email protected]> |
--===============0859309336==
Content-Language: en-US
Content-Type: multipart/alternative;
boundary="_000_B71057A42F7488498D6FAF859D9283FE371B144BEDPEX02globalit_"
--_000_B71057A42F7488498D6FAF859D9283FE371B144BEDPEX02globalit_
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
Hello,
We are trying to use xmlsec1 utility in order to verify a soap response wit=
h a <Signature xmlns=3D"http://www.w3.org/2000/09/xmldsig#"> element.
This is the KeyInfo element in the soap envelope (I removed the actual key =
identifier data):
<KeyInfo>
<wsse:SecurityTokenReference xmlns=3D"">
<wsse:KeyIdentifier ValueType=3D"http://doc=
s.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509Su=
bjectKeyIdentifier" EncodingType=3D"http://docs.oasis-open.org/wss/2004/01/=
oasis-200401-wss-soap-message-security-1.0#Base64Binary">[BASE64 STRING]</w=
sse:KeyIdentifier>
</wsse:SecurityTokenReference>
</KeyInfo>
I'm running the following command in order to verify the signature:
/usr/bin/xmlsec1 --verify answer.xml
Getting the following error:
func=3DxmlSecXPathDataExecute:file=3Dxpath.c:line=3D273:obj=3Dunknown:subj=
=3DxmlXPtrEval:error=3D5:libxml2 library function failed:expr=3Dxpointer(id=
('Id-c96770b6-807c-44e5-b070-9a01f2fcf9ef'))
func=3DxmlSecXPathDataListExecute:file=3Dxpath.c:line=3D373:obj=3Dunknown:s=
ubj=3DxmlSecXPathDataExecute:error=3D1:xmlsec library function failed:
func=3DxmlSecTransformXPathExecute:file=3Dxpath.c:line=3D483:obj=3Dxpointer=
:subj=3DxmlSecXPathDataExecute:error=3D1:xmlsec library function failed:
func=3DxmlSecTransformDefaultPushXml:file=3Dtransforms.c:line=3D2405:obj=3D=
xpointer:subj=3DxmlSecTransformExecute:error=3D1:xmlsec library function fa=
iled:
func=3DxmlSecTransformCtxXmlExecute:file=3Dtransforms.c:line=3D1236:obj=3Du=
nknown:subj=3DxmlSecTransformPushXml:error=3D1:xmlsec library function fail=
ed:transform=3Dxpointer
func=3DxmlSecTransformCtxExecute:file=3Dtransforms.c:line=3D1296:obj=3Dunkn=
own:subj=3DxmlSecTransformCtxXmlExecute:error=3D1:xmlsec library function f=
ailed:
func=3DxmlSecDSigReferenceCtxProcessNode:file=3Dxmldsig.c:line=3D1571:obj=
=3Dunknown:subj=3DxmlSecTransformCtxExecute:error=3D1:xmlsec library functi=
on failed:
func=3DxmlSecDSigCtxProcessSignedInfoNode:file=3Dxmldsig.c:line=3D804:obj=
=3Dunknown:subj=3DxmlSecDSigReferenceCtxProcessNode:error=3D1:xmlsec librar=
y function failed:node=3DReference
func=3DxmlSecDSigCtxProcessSignatureNode:file=3Dxmldsig.c:line=3D547:obj=3D=
unknown:subj=3DxmlSecDSigCtxProcessSignedInfoNode:error=3D1:xmlsec library =
function failed:
func=3DxmlSecDSigCtxVerify:file=3Dxmldsig.c:line=3D366:obj=3Dunknown:subj=
=3DxmlSecDSigCtxSignatureProcessNode:error=3D1:xmlsec library function fail=
ed:
Error: signature failed
ERROR
SignedInfo References (ok/all): 0/1
Manifests References (ok/all): 0/0
Error: failed to verify file "answer.xml"
Can you please advise?
Tomer.
--_000_B71057A42F7488498D6FAF859D9283FE371B144BEDPEX02globalit_
Content-Type: text/html; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
<html xmlns:v=3D"urn:schemas-microsoft-com:vml" xmlns:o=3D"urn:schemas-micr=
osoft-com:office:office" xmlns:w=3D"urn:schemas-microsoft-com:office:word" =
xmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" xmlns=3D"http:=
//www.w3.org/TR/REC-html40">
<head>
<meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3Dus-ascii"=
>
<meta name=3D"Generator" content=3D"Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
text-align:right;
direction:rtl;
unicode-bidi:embed;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
mso-margin-top-alt:auto;
margin-right:0cm;
mso-margin-bottom-alt:auto;
margin-left:0cm;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
span.EmailStyle18
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 90.0pt 72.0pt 90.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext=3D"edit" spidmax=3D"1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext=3D"edit">
<o:idmap v:ext=3D"edit" data=3D"1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang=3D"EN-US" link=3D"#0563C1" vlink=3D"#954F72">
<div class=3D"WordSection1">
<p class=3D"MsoNormal" style=3D"text-align:left;direction:ltr;unicode-bidi:=
embed">Hello,<o:p></o:p></p>
<p class=3D"MsoNormal" style=3D"text-align:left;direction:ltr;unicode-bidi:=
embed"><o:p> </o:p></p>
<p class=3D"MsoNormal" style=3D"text-align:left;direction:ltr;unicode-bidi:=
embed">We are trying to use xmlsec1 utility in order to verify a soap respo=
nse with a <Signature xmlns=3D"http://www.w3.org/2000/09/xmldsig#&q=
uot;> element.<o:p></o:p></p>
<p class=3D"MsoNormal" style=3D"text-align:left;direction:ltr;unicode-bidi:=
embed">This is the KeyInfo element in the soap envelope (I removed the actu=
al key identifier data):<o:p></o:p></p>
<p class=3D"MsoNormal" style=3D"text-align:left;direction:ltr;unicode-bidi:=
embed"><o:p> </o:p></p>
<p class=3D"MsoNormal" style=3D"text-align:left;direction:ltr;unicode-bidi:=
embed"><KeyInfo><o:p></o:p></p>
<p class=3D"MsoNormal" style=3D"text-align:left;direction:ltr;unicode-bidi:=
embed"> &n=
bsp; <wsse:SecurityTokenReference xmlns=3D""=
><o:p></o:p></p>
<p class=3D"MsoNormal" style=3D"text-align:left;direction:ltr;unicode-bidi:=
embed"> &n=
bsp;  =
; <wsse:KeyIdentifier ValueTyp=
e=3D"http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-toke=
n-profile-1.0#X509SubjectKeyIdentifier" EncodingType=3D"http://do=
cs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Ba=
se64Binary">[BASE64
STRING]</wsse:KeyIdentifier><o:p></o:p></p>
<p class=3D"MsoNormal" style=3D"text-align:left;direction:ltr;unicode-bidi:=
embed"> &n=
bsp; </wsse:SecurityTokenReference><o:p></o:p></p>
<p class=3D"MsoNormal" style=3D"text-align:left;direction:ltr;unicode-bidi:=
embed"></KeyInfo><o:p></o:p></p>
<p class=3D"MsoNormal" style=3D"text-align:left;direction:ltr;unicode-bidi:=
embed"><o:p> </o:p></p>
<p class=3D"MsoNormal" style=3D"text-align:left;direction:ltr;unicode-bidi:=
embed">I'm running the following command in order to verify the signature:<=
o:p></o:p></p>
<p class=3D"MsoNormal" style=3D"text-align:left;direction:ltr;unicode-bidi:=
embed">/usr/bin/xmlsec1 --verify answer.xml<o:p></o:p></p>
<p class=3D"MsoNormal" style=3D"text-align:left;direction:ltr;unicode-bidi:=
embed"><o:p> </o:p></p>
<p class=3D"MsoNormal" style=3D"text-align:left;direction:ltr;unicode-bidi:=
embed">Getting the following error:<o:p></o:p></p>
<p class=3D"MsoNormal" style=3D"text-align:left;direction:ltr;unicode-bidi:=
embed"><o:p> </o:p></p>
<p class=3D"MsoNormal" style=3D"text-align:left;direction:ltr;unicode-bidi:=
embed">func=3DxmlSecXPathDataExecute:file=3Dxpath.c:line=3D273:obj=3Dunknow=
n:subj=3DxmlXPtrEval:error=3D5:libxml2 library function failed:expr=3Dxpoin=
ter(id('Id-c96770b6-807c-44e5-b070-9a01f2fcf9ef'))<o:p></o:p></p>
<p class=3D"MsoNormal" style=3D"text-align:left;direction:ltr;unicode-bidi:=
embed">func=3DxmlSecXPathDataListExecute:file=3Dxpath.c:line=3D373:obj=3Dun=
known:subj=3DxmlSecXPathDataExecute:error=3D1:xmlsec library function faile=
d:
<o:p></o:p></p>
<p class=3D"MsoNormal" style=3D"text-align:left;direction:ltr;unicode-bidi:=
embed">func=3DxmlSecTransformXPathExecute:file=3Dxpath.c:line=3D483:obj=3Dx=
pointer:subj=3DxmlSecXPathDataExecute:error=3D1:xmlsec library function fai=
led:
<o:p></o:p></p>
<p class=3D"MsoNormal" style=3D"text-align:left;direction:ltr;unicode-bidi:=
embed">func=3DxmlSecTransformDefaultPushXml:file=3Dtransforms.c:line=3D2405=
:obj=3Dxpointer:subj=3DxmlSecTransformExecute:error=3D1:xmlsec library func=
tion failed:
<o:p></o:p></p>
<p class=3D"MsoNormal" style=3D"text-align:left;direction:ltr;unicode-bidi:=
embed">func=3DxmlSecTransformCtxXmlExecute:file=3Dtransforms.c:line=3D1236:=
obj=3Dunknown:subj=3DxmlSecTransformPushXml:error=3D1:xmlsec library functi=
on failed:transform=3Dxpointer<o:p></o:p></p>
<p class=3D"MsoNormal" style=3D"text-align:left;direction:ltr;unicode-bidi:=
embed">func=3DxmlSecTransformCtxExecute:file=3Dtransforms.c:line=3D1296:obj=
=3Dunknown:subj=3DxmlSecTransformCtxXmlExecute:error=3D1:xmlsec library fun=
ction failed:
<o:p></o:p></p>
<p class=3D"MsoNormal" style=3D"text-align:left;direction:ltr;unicode-bidi:=
embed">func=3DxmlSecDSigReferenceCtxProcessNode:file=3Dxmldsig.c:line=3D157=
1:obj=3Dunknown:subj=3DxmlSecTransformCtxExecute:error=3D1:xmlsec library f=
unction failed:
<o:p></o:p></p>
<p class=3D"MsoNormal" style=3D"text-align:left;direction:ltr;unicode-bidi:=
embed">func=3DxmlSecDSigCtxProcessSignedInfoNode:file=3Dxmldsig.c:line=3D80=
4:obj=3Dunknown:subj=3DxmlSecDSigReferenceCtxProcessNode:error=3D1:xmlsec l=
ibrary function failed:node=3DReference<o:p></o:p></p>
<p class=3D"MsoNormal" style=3D"text-align:left;direction:ltr;unicode-bidi:=
embed">func=3DxmlSecDSigCtxProcessSignatureNode:file=3Dxmldsig.c:line=3D547=
:obj=3Dunknown:subj=3DxmlSecDSigCtxProcessSignedInfoNode:error=3D1:xmlsec l=
ibrary function failed:
<o:p></o:p></p>
<p class=3D"MsoNormal" style=3D"text-align:left;direction:ltr;unicode-bidi:=
embed">func=3DxmlSecDSigCtxVerify:file=3Dxmldsig.c:line=3D366:obj=3Dunknown=
:subj=3DxmlSecDSigCtxSignatureProcessNode:error=3D1:xmlsec library function=
failed:
<o:p></o:p></p>
<p class=3D"MsoNormal" style=3D"text-align:left;direction:ltr;unicode-bidi:=
embed">Error: signature failed
<o:p></o:p></p>
<p class=3D"MsoNormal" style=3D"text-align:left;direction:ltr;unicode-bidi:=
embed">ERROR<o:p></o:p></p>
<p class=3D"MsoNormal" style=3D"text-align:left;direction:ltr;unicode-bidi:=
embed">SignedInfo References (ok/all): 0/1<o:p></o:p></p>
<p class=3D"MsoNormal" style=3D"text-align:left;direction:ltr;unicode-bidi:=
embed">Manifests References (ok/all): 0/0<o:p></o:p></p>
<p class=3D"MsoNormal" style=3D"text-align:left;direction:ltr;unicode-bidi:=
embed">Error: failed to verify file "answer.xml"<o:p></o:p></p>
<p class=3D"MsoNormal" style=3D"text-align:left;direction:ltr;unicode-bidi:=
embed"><o:p> </o:p></p>
<p class=3D"MsoNormal" style=3D"text-align:left;direction:ltr;unicode-bidi:=
embed">Can you please advise?<o:p></o:p></p>
<p class=3D"MsoNormal" style=3D"text-align:left;direction:ltr;unicode-bidi:=
embed"><o:p> </o:p></p>
<p class=3D"MsoNormal" style=3D"text-align:left;direction:ltr;unicode-bidi:=
embed">Tomer.<o:p></o:p></p>
</div>
</body>
</html>
--_000_B71057A42F7488498D6FAF859D9283FE371B144BEDPEX02globalit_--
--===============0859309336==
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: base64
Content-Disposition: inline
X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18KeG1sc2VjIG1h
aWxpbmcgbGlzdAp4bWxzZWNAYWxla3NleS5jb20KaHR0cDovL3d3dy5hbGVrc2V5LmNvbS9tYWls
bWFuL2xpc3RpbmZvL3htbHNlYwo=
--===============0859309336==--