Quantcast
Channel: Claims based access platform (CBA), code-named Geneva forum
Viewing all articles
Browse latest Browse all 2535

Using WIF to read a message whose signature doesn't have KeyInfo

$
0
0

Hi,

I'm using WIF to read a message whose signature doesn't have KeyInfo element

 

<Response ID="idc640375b45ac4293ae9a70bab7991991" Version="2.0" IssueInstant="2016-01-11T09:40:28.6192428Z" Destination="https://idp.example.local/..." InResponseTo="idd14f45aa327748269e2d4adba05e52cd" xmlns="urn:oasis:names:tc:SAML:2.0:protocol">

 <Issuer xmlns="urn:oasis:names:tc:SAML:2.0:assertion">https://samples.example.local/.../</Issuer>

 <Signature xmlns="http://www.w3.org/2000/09/xmldsig#">

  <SignedInfo>

   <CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />

   <SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256" />

   <Reference URI="#idc640375b45ac4293ae9a70bab7991991">

    <Transforms>

     <Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" />

     <Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />

    </Transforms>

    <DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256" />

    <DigestValue>BvSo2SLM+rL+FCx9UwiWApIbT12/9ffKZbN9Iuc1O54=</DigestValue>

   </Reference>

  </SignedInfo>

  <SignatureValue>IkQ7iPrTPzmc+DWJ4J9AfBmZm1cOLrVQu2o6Dd0/jKvWp3xb8D1gNqrShHo57qx8t0cLatW2ZJvC/YtGCuXNUlm8VM7OTakn3rSBUJmY+5yWyhkD+EOPkBOZFoXYjQCtfLXaZhM8sYYeJnPEEpRF9Nl/Mop/15aQjbRczmiPiy0lgohMjF/TIQp401CUNbXcHsvUf+DDcTqNmUoyXE0cbrKr351bIqXsPLagQ7OW0nVDwD0B2s4uYkPR8ZJegaSma9keGI4fqRTteubRTznrxFdbi4yWof9McdlsYpzvaqIJsoQHSEpiKXeg1sK83KxLgMfHyRofznD7BW6iFhHAlA==</SignatureValue>

 </Signature>

 <Status>

  <StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" />

 </Status>

WIF refuses to process the message and throws an exception:

[InvalidOperationException: ID3276: The signing credentials cannot be resolved because signed XML does not contain a SecurityKeyIdentifier.]
   System.IdentityModel.EnvelopedSignatureReader.ResolveSigningCredentials() +527
   System.IdentityModel.EnvelopedSignatureReader.OnEndOfRootElement() +55
   System.IdentityModel.EnvelopedSignatureReader.Read() +90
   System.Xml.XmlReader.ReadEndElement() +54
But according to https://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf, section 5.4.5, such

signature is valid: "XML Signature defines usage of the <ds:KeyInfo> element. SAML does not require the use of <ds:KeyInfo>, nor does it impose any restrictions on its use. Therefore, <ds:KeyInfo> MAY be absent."

Could anyone please show me if there is a workaround for this issue? Why does WIF enforce such a rule? To make the situation more frustrating, all the relevant classes are marked as internal which makes extending them impossible.

Thank you in advance,

Thuan.



Viewing all articles
Browse latest Browse all 2535

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>