Problem verifying SAML response signature with xmlsec API
"Elena Fedorov" <[email protected]> Thu, 7 Nov 2019 16:11:26 -0500
| Newsgroups | gmane.text.xml.xmlsec |
|---|---|
| Message-ID | <OF9AEDDAED.1DA016B7-ON002584AB.00731744-852584AB.00746782@notes.na.collabserv.com> |
--===============1123170846==
Content-type: multipart/alternative;
Boundary="0__=8FBB0E38DFE091D48f9e8a93df938690918c8FBB0E38DFE091D4"
Content-Disposition: inline
--0__=8FBB0E38DFE091D48f9e8a93df938690918c8FBB0E38DFE091D4
Content-Transfer-Encoding: quoted-printable
Content-type: text/plain; charset=US-ASCII
Hello,
I've spent a few days trying to verify a signature in the SAML response.
If I run a command line xmlsec1 - I can verify the signature fine:
xmlsec1 --verify --id-attr:ID
urn:oasis:names:tc:SAML:2.0:assertion:Assertion --trusted-pem myCert.pem
samlResponse.xml
Verifying a signature of the same saml using xmlsec api (code similar to
verify4.c example) gives these errors:
func=3DxmlSecTransformIdListFindByHref:file=3Dtransforms.c:line=3D2239:obj=
=3Dunknown:subj=3DxmlSecPtrListCheckId
(list, xmlSecTransformIdListId):error=3D100:assertion:
func=3DxmlSecTransformNodeRead:file=3Dtransforms.c:line=3D1315:obj=3Dunknow=
n:subj=3DxmlSecTransformIdListFindByHref:error=3D1:xmlsec
library function failed:href=3D
http://www.w3.org/2001/10/xml-exc-c14n#
func=3DxmlSecTransformCtxNodeRead:file=3Dtransforms.c:line=3D596:obj=3DCano=
nicalizationMethod:subj=3DxmlSecTransformNodeRead:error=3D1:xmlsec
library function failed:
func=3DxmlSecDSigCtxProcessSignedInfoNode:file=3Dxmldsig.c:line=3D623:obj=
=3Dunknown:subj=3DxmlSecTransformCtxNodeRead:error=3D1:xmlsec
library function failed:node=3DCanonicalizationMethod
func=3DxmlSecDSigCtxProcessSignatureNode:file=3Dxmldsig.c:line=3D497:obj=3D=
unknown:subj=3DxmlSecDSigCtxProcessSignedInfoNode:error=3D1:xmlsec
library function failed:
func=3DxmlSecDSigCtxVerify:file=3Dxmldsig.c:line=3D346:obj=3Dunknown:subj=
=3DxmlSecDSigCtxProcessSignatureNode:error=3D1:xmlsec
library function failed:
I tried updating xmlsec1 version from 1.2.20 (openssl) to 1.2.29 (openssl)
- but it did not help. Still getting the same exception stack.
I generated dump:
=3D VERIFICATION CONTEXT
=3D=3D Status: unknown
=3D=3D flags: 0x00000000
=3D=3D flags2: 0x00000000
=3D=3D Key Info Read Ctx:
=3D KEY INFO READ CONTEXT
=3D=3D flags: 0x00000000
=3D=3D flags2: 0x00000000
=3D=3D enabled key data: all
=3D=3D RetrievalMethod level (cur/max): 0/1
=3D=3D TRANSFORMS CTX (status=3D0)
=3D=3D flags: 0x00000000
=3D=3D flags2: 0x00000000
=3D=3D enabled transforms: all
=3D=3D=3D uri: NULL
=3D=3D=3D uri xpointer expr: NULL
=3D=3D EncryptedKey level (cur/max): 0/1
=3D=3D=3D KeyReq:
=3D=3D=3D=3D keyId: NULL
=3D=3D=3D=3D keyType: 0x00000000
=3D=3D=3D=3D keyUsage: 0xffffffff
=3D=3D=3D=3D keyBitsSize: 0
=3D=3D=3D list size: 0
=3D=3D Key Info Write Ctx:
=3D KEY INFO WRITE CONTEXT
=3D=3D flags: 0x00000000
=3D=3D flags2: 0x00000000
=3D=3D enabled key data: all
=3D=3D RetrievalMethod level (cur/max): 0/1
=3D=3D TRANSFORMS CTX (status=3D0)
=3D=3D flags: 0x00000000
=3D=3D flags2: 0x00000000
=3D=3D enabled transforms: all
=3D=3D=3D uri: NULL
=3D=3D=3D uri xpointer expr: NULL
=3D=3D EncryptedKey level (cur/max): 0/1
=3D=3D=3D KeyReq:
=3D=3D=3D=3D keyId: NULL
=3D=3D=3D=3D keyType: 0x00000001
=3D=3D=3D=3D keyUsage: 0xffffffff
=3D=3D=3D=3D keyBitsSize: 0
=3D=3D=3D list size: 0
=3D=3D Signature Transform Ctx:
=3D=3D TRANSFORMS CTX (status=3D0)
=3D=3D flags: 0x00000000
=3D=3D flags2: 0x00000000
=3D=3D enabled transforms: all
=3D=3D=3D uri: NULL
=3D=3D=3D uri xpointer expr: NULL
=3D=3D SignedInfo References List:
=3D=3D=3D list size: 0
=3D=3D Manifest References List:
=3D=3D=3D list size: 0
=3D REFERENCE VERIFICATION CONTEXT
=3D=3D Status: unknown
=3D=3D Reference Transform Ctx:
=3D=3D TRANSFORMS CTX (status=3D0)
=3D=3D flags: 0x00000000
=3D=3D flags2: 0x00000000
=3D=3D enabled transforms: all
=3D=3D=3D uri: NULL
=3D=3D=3D uri xpointer expr: NULL
An example signature in the SAML:
<ds:Signature xmlns:ds=3D"http://www.w3.org/2000/09/xmldsig#">
<ds:SignedInfo>
<ds:CanonicalizationMethod Algorithm=3D"
http://www.w3.org/2001/10/xml-exc-c14n#" />
<ds:SignatureMethod Algorithm=3D"
http://www.w3.org/2001/04/xmldsig-more#rsa-sha256" />
<ds:Reference
URI=3D"#=5F17ba951-d40a-4fa6-83e9-405v11ab6d01">
<ds:Transforms>
<ds:Transform Algorithm=3D"
http://www.w3.org/2000/09/xmldsig#enveloped-signature" />
<ds:Transform Algorithm=3D"
http://www.w3.org/2001/10/xml-exc-c14n#" />
</ds:Transforms>
<ds:DigestMethod Algorithm=3D"
http://www.w3.org/2001/04/xmlenc#sha256" />
<ds:DigestValue>......</ds:DigestValue>
</ds:Reference>
</ds:SignedInfo>
<ds:SignatureValue>ZqbHJI9GUOXV8gfKGHjaHY8iTXJiQd...</ds:SignatureValue>
<KeyInfo xmlns=3D"http://www.w3.org/2000/09/xmldsig#">
<ds:X509Data>
<ds:X509Certificate>....</ds:X509Certificate>
</ds:X509Data>
</KeyInfo>
</ds:Signature>
--0__=8FBB0E38DFE091D48f9e8a93df938690918c8FBB0E38DFE091D4
Content-Transfer-Encoding: quoted-printable
Content-type: text/html; charset=US-ASCII
Content-Disposition: inline
<html><body><p><font face=3D"Arial">Hello,</font><br><font face=3D"Arial">I=
've spent a few days trying to verify a signature in the SAML response.</fo=
nt><br><font face=3D"Arial">If I run a command line xmlsec1 - I can verify =
the signature fine:</font><br><br><b><font face=3D"Arial">xmlsec1 --verify =
--id-attr:ID urn:oasis:names:tc:SAML:2.0:assertion:Assertion --trusted-pem =
myCert.pem samlResponse.xml</font></b><br><br><font face=3D"Arial">Verifyin=
g a signature of the same saml using xmlsec api (code similar to verify4.c =
example) gives these errors:</font><br><br><b><font face=3D"Arial">func=3Dx=
mlSecTransformIdListFindByHref:file=3Dtransforms.c:line=3D2239:obj=3Dunknow=
n:subj=3DxmlSecPtrListCheckId(list, xmlSecTransformIdListId):error=3D100:as=
sertion:</font></b><br><b><font face=3D"Arial">func=3DxmlSecTransformNodeRe=
ad:file=3Dtransforms.c:line=3D1315:obj=3Dunknown:subj=3DxmlSecTransformIdLi=
stFindByHref:error=3D1:xmlsec library function failed:href=3D</font></b><a =
href=3D"http://www.w3.org/2001/10/xml-exc-c14n#"><b><font face=3D"Arial">ht=
tp://www.w3.org/2001/10/xml-exc-c14n#</font></b></a><br><b><font face=3D"Ar=
ial">func=3DxmlSecTransformCtxNodeRead:file=3Dtransforms.c:line=3D596:obj=
=3DCanonicalizationMethod:subj=3DxmlSecTransformNodeRead:error=3D1:xmlsec l=
ibrary function failed:</font></b><br><b><font face=3D"Arial">func=3DxmlSec=
DSigCtxProcessSignedInfoNode:file=3Dxmldsig.c:line=3D623:obj=3Dunknown:subj=
=3DxmlSecTransformCtxNodeRead:error=3D1:xmlsec library function failed:node=
=3DCanonicalizationMethod</font></b><br><b><font face=3D"Arial">func=3DxmlS=
ecDSigCtxProcessSignatureNode:file=3Dxmldsig.c:line=3D497:obj=3Dunknown:sub=
j=3DxmlSecDSigCtxProcessSignedInfoNode:error=3D1:xmlsec library function fa=
iled:</font></b><br><b><font face=3D"Arial">func=3DxmlSecDSigCtxVerify:file=
=3Dxmldsig.c:line=3D346:obj=3Dunknown:subj=3DxmlSecDSigCtxProcessSignatureN=
ode:error=3D1:xmlsec library function failed:</font></b><br><br><font face=
=3D"Arial">I tried updating xmlsec1 version from 1.2.20 (openssl) to 1.2.29=
(openssl) - but it did not help. Still getting the same exception stack.<=
/font><br><br><br><font face=3D"Arial">I generated dump:</font><br><br><fon=
t face=3D"Arial">=3D VERIFICATION CONTEXT</font><br><font face=3D"Arial">=
=3D=3D Status: unknown</font><br><font face=3D"Arial">=3D=3D flags: 0x00000=
000</font><br><font face=3D"Arial">=3D=3D flags2: 0x00000000</font><br><fon=
t face=3D"Arial">=3D=3D Key Info Read Ctx:</font><br><font face=3D"Arial">=
=3D KEY INFO READ CONTEXT</font><br><font face=3D"Arial">=3D=3D flags: 0x00=
000000</font><br><font face=3D"Arial">=3D=3D flags2: 0x00000000</font><br><=
font face=3D"Arial">=3D=3D enabled key data: all</font><br><font face=3D"Ar=
ial">=3D=3D RetrievalMethod level (cur/max): 0/1</font><br><font face=3D"Ar=
ial">=3D=3D TRANSFORMS CTX (status=3D0)</font><br><font face=3D"Arial">=3D=
=3D flags: 0x00000000</font><br><font face=3D"Arial">=3D=3D flags2: 0x00000=
000</font><br><font face=3D"Arial">=3D=3D enabled transforms: all</font><br=
><font face=3D"Arial">=3D=3D=3D uri: NULL</font><br><font face=3D"Arial">=
=3D=3D=3D uri xpointer expr: NULL</font><br><font face=3D"Arial">=3D=3D Enc=
ryptedKey level (cur/max): 0/1</font><br><font face=3D"Arial">=3D=3D=3D Key=
Req:</font><br><font face=3D"Arial">=3D=3D=3D=3D keyId: NULL</font><br><fon=
t face=3D"Arial">=3D=3D=3D=3D keyType: 0x00000000</font><br><font face=3D"A=
rial">=3D=3D=3D=3D keyUsage: 0xffffffff</font><br><font face=3D"Arial">=3D=
=3D=3D=3D keyBitsSize: 0</font><br><font face=3D"Arial">=3D=3D=3D list size=
: 0</font><br><font face=3D"Arial">=3D=3D Key Info Write Ctx:</font><br><fo=
nt face=3D"Arial">=3D KEY INFO WRITE CONTEXT</font><br><font face=3D"Arial"=
>=3D=3D flags: 0x00000000</font><br><font face=3D"Arial">=3D=3D flags2: 0x0=
0000000</font><br><font face=3D"Arial">=3D=3D enabled key data: all</font><=
br><font face=3D"Arial">=3D=3D RetrievalMethod level (cur/max): 0/1</font><=
br><font face=3D"Arial">=3D=3D TRANSFORMS CTX (status=3D0)</font><br><font =
face=3D"Arial">=3D=3D flags: 0x00000000</font><br><font face=3D"Arial">=3D=
=3D flags2: 0x00000000</font><br><font face=3D"Arial">=3D=3D enabled transf=
orms: all</font><br><font face=3D"Arial">=3D=3D=3D uri: NULL</font><br><fon=
t face=3D"Arial">=3D=3D=3D uri xpointer expr: NULL</font><br><font face=3D"=
Arial">=3D=3D EncryptedKey level (cur/max): 0/1</font><br><font face=3D"Ari=
al">=3D=3D=3D KeyReq:</font><br><font face=3D"Arial">=3D=3D=3D=3D keyId: NU=
LL</font><br><font face=3D"Arial">=3D=3D=3D=3D keyType: 0x00000001</font><b=
r><font face=3D"Arial">=3D=3D=3D=3D keyUsage: 0xffffffff</font><br><font fa=
ce=3D"Arial">=3D=3D=3D=3D keyBitsSize: 0</font><br><font face=3D"Arial">=3D=
=3D=3D list size: 0</font><br><font face=3D"Arial">=3D=3D Signature Transfo=
rm Ctx:</font><br><font face=3D"Arial">=3D=3D TRANSFORMS CTX (status=3D0)</=
font><br><font face=3D"Arial">=3D=3D flags: 0x00000000</font><br><font face=
=3D"Arial">=3D=3D flags2: 0x00000000</font><br><font face=3D"Arial">=3D=3D =
enabled transforms: all</font><br><font face=3D"Arial">=3D=3D=3D uri: NULL<=
/font><br><font face=3D"Arial">=3D=3D=3D uri xpointer expr: NULL</font><br>=
<font face=3D"Arial">=3D=3D SignedInfo References List:</font><br><font fac=
e=3D"Arial">=3D=3D=3D list size: 0</font><br><font face=3D"Arial">=3D=3D Ma=
nifest References List:</font><br><font face=3D"Arial">=3D=3D=3D list size:=
0</font><br><font face=3D"Arial">=3D REFERENCE VERIFICATION CONTEXT</font>=
<br><font face=3D"Arial">=3D=3D Status: unknown</font><br><font face=3D"Ari=
al">=3D=3D Reference Transform Ctx:</font><br><font face=3D"Arial">=3D=3D T=
RANSFORMS CTX (status=3D0)</font><br><font face=3D"Arial">=3D=3D flags: 0x0=
0000000</font><br><font face=3D"Arial">=3D=3D flags2: 0x00000000</font><br>=
<font face=3D"Arial">=3D=3D enabled transforms: all</font><br><font face=3D=
"Arial">=3D=3D=3D uri: NULL</font><br><font face=3D"Arial">=3D=3D=3D uri xp=
ointer expr: NULL</font><br><br><b><font face=3D"Arial">An example signatur=
e in the SAML:</font></b><br><br><font face=3D"Arial"> <ds:Signat=
ure xmlns:ds=3D"</font><a href=3D"http://www.w3.org/2000/09/xmldsig#">=
<font face=3D"Arial">http://www.w3.org/2000/09/xmldsig#</font></a><font fac=
e=3D"Arial">"></font><br><font face=3D"Arial"> =
<ds:SignedInfo></font><br><font face=3D"Arial"> =
<ds:CanonicalizationMethod Algorithm=3D"</font><a href=
=3D"http://www.w3.org/2001/10/xml-exc-c14n#"><font face=3D"Arial">http://ww=
w.w3.org/2001/10/xml-exc-c14n#</font></a><font face=3D"Arial">" /><=
/font><br><font face=3D"Arial"> <ds:Signa=
tureMethod Algorithm=3D"</font><a href=3D"http://www.w3.org/2001/04/xm=
ldsig-more#rsa-sha256"><font face=3D"Arial">http://www.w3.org/2001/04/xmlds=
ig-more#rsa-sha256</font></a><font face=3D"Arial">" /></font><br><f=
ont face=3D"Arial"> <ds:Reference URI=3D&=
quot;#=5F17ba951-d40a-4fa6-83e9-405v11ab6d01"></font><br><font face=
=3D"Arial"> <ds:Transforms></f=
ont><br><font face=3D"Arial"> =
<ds:Transform Algorithm=3D"</font><a href=3D"http://www.w3.org/20=
00/09/xmldsig#enveloped-signature"><font face=3D"Arial">http://www.w3.org/2=
000/09/xmldsig#enveloped-signature</font></a><font face=3D"Arial">" /&=
gt;</font><br><font face=3D"Arial"> =
<ds:Transform Algorithm=3D"</font><a href=3D"http://www.w3.=
org/2001/10/xml-exc-c14n#"><font face=3D"Arial">http://www.w3.org/2001/10/x=
ml-exc-c14n#</font></a><font face=3D"Arial">" /></font><br><font fa=
ce=3D"Arial"> </ds:Transforms>=
</font><br><font face=3D"Arial"> <=
;ds:DigestMethod Algorithm=3D"</font><a href=3D"http://www.w3.org/2001=
/04/xmlenc#sha256"><font face=3D"Arial">http://www.w3.org/2001/04/xmlenc#sh=
a256</font></a><font face=3D"Arial">" /></font><br><font face=3D"Ar=
ial"> <ds:DigestValue>......&l=
t;/ds:DigestValue></font><br><font face=3D"Arial"> =
</ds:Reference></font><br><font face=3D"Arial"> =
</ds:SignedInfo></font><br><font face=3D"Arial"> =
<ds:SignatureValue>ZqbHJI9GUOXV8gfKGHjaHY8iTXJiQd...&l=
t;/ds:SignatureValue></font><br><font face=3D"Arial"> =
<KeyInfo xmlns=3D"</font><a href=3D"http://www.w3.org/2000/09/=
xmldsig#"><font face=3D"Arial">http://www.w3.org/2000/09/xmldsig#</font></a=
><font face=3D"Arial">"></font><br><font face=3D"Arial"> =
<ds:X509Data></font><br><font face=3D"Arial"> =
<ds:X509Certificate>....</ds:=
X509Certificate></font><br><font face=3D"Arial"> =
</ds:X509Data></font><br><font face=3D"Arial"> =
</KeyInfo></font><br><font face=3D"Arial"> &l=
t;/ds:Signature></font><br><BR>
</body></html>
--0__=8FBB0E38DFE091D48f9e8a93df938690918c8FBB0E38DFE091D4--
--===============1123170846==
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: base64
Content-Disposition: inline
X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18KeG1sc2VjIG1h
aWxpbmcgbGlzdAp4bWxzZWNAYWxla3NleS5jb20KaHR0cDovL3d3dy5hbGVrc2V5LmNvbS9tYWls
bWFuL2xpc3RpbmZvL3htbHNlYwo=
--===============1123170846==--