Hi, all
We are testing using ADFS as IDP and Java OpenSaml as SP. However, the validation of the SAML assertion from ADFS keeps failing. I have tracked it down to the canonicalization issue of the ADFS assertions:
Here is what’s from ADFS:
<saml:Assertion Version="2.0" ID="_c30603e8-9e7a-4a1b-b72b-a8c1af6d5be6" IssueInstant="2014-09-17T14:58:33.642Z" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">
Here is what’s Java canonicalized:
<saml:Assertion xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" ID="_c30603e8-9e7a-4a1b-b72b-a8c1af6d5be6" IssueInstant="2014-09-17T14:58:33.642Z" Version="2.0">
Based on http://www.ibm.com/developerworks/library/x-c14n/, the Java one seems to be the correct one.
So, the question is: does anybody know why the ADFS server is not following the SAML standard? It already states it's using the Canonicalization Method like bellow:
<ds:SignedInfo>
<ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
Does anybody know if there is any configuration to fix the ADFS canonicalization?
Thanks a lot in advance.
- Hao
We are testing using ADFS as IDP and Java OpenSaml as SP. However, the validation of the SAML assertion from ADFS keeps failing. I have tracked it down to the canonicalization issue of the ADFS assertions:
Here is what’s from ADFS:
<saml:Assertion Version="2.0" ID="_c30603e8-9e7a-4a1b-b72b-a8c1af6d5be6" IssueInstant="2014-09-17T14:58:33.642Z" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">
Here is what’s Java canonicalized:
<saml:Assertion xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" ID="_c30603e8-9e7a-4a1b-b72b-a8c1af6d5be6" IssueInstant="2014-09-17T14:58:33.642Z" Version="2.0">
Based on http://www.ibm.com/developerworks/library/x-c14n/, the Java one seems to be the correct one.
So, the question is: does anybody know why the ADFS server is not following the SAML standard? It already states it's using the Canonicalization Method like bellow:
<ds:SignedInfo>
<ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
Does anybody know if there is any configuration to fix the ADFS canonicalization?
Thanks a lot in advance.
- Hao