You are viewing a plain text version of this content. The canonical link for it is here.
Posted to wss4j-dev@ws.apache.org by dstrower <da...@alltel.com> on 2007/09/16 15:27:49 UTC
Can the location of the signature be controlled?
I am trying to sign a message with a SAML token. I am able to do this but the
format looks like this:
Security
signature
saml
My server requires that the signature be inside the SAML assertion.
Can I control where the signature is placed?
--
View this message in context: http://www.nabble.com/Can-the-location-of-the-signature-be-controlled--tf4451302.html#a12699525
Sent from the WSS4J mailing list archive at Nabble.com.
---------------------------------------------------------------------
To unsubscribe, e-mail: wss4j-dev-unsubscribe@ws.apache.org
For additional commands, e-mail: wss4j-dev-help@ws.apache.org
Re: Can the location of the signature be controlled?
Posted by dstrower <da...@alltel.com>.
Thanks guys,
You got me thinking in the write direction. I see now what I need is a
signed SAML assertion. This can be done using Opensaml. I can created the
saml assertion and then sign it just using opensaml.
But now my problem is that if I insert the saml insertion into the security
header But now my problem is that if I insert the saml insertion into the
security header the message is always off by a few spaces. Normaly I would
not care but the minor changes does invalidate the singature.
dstrower wrote:
>
> I am trying to sign a message with a SAML token. I am able to do this but
> the format looks like this:
> Security
> signature
> saml
>
> My server requires that the signature be inside the SAML assertion.
> Can I control where the signature is placed?
>
--
View this message in context: http://www.nabble.com/Can-the-location-of-the-signature-be-controlled--tf4451302.html#a12757409
Sent from the WSS4J mailing list archive at Nabble.com.
---------------------------------------------------------------------
To unsubscribe, e-mail: wss4j-dev-unsubscribe@ws.apache.org
For additional commands, e-mail: wss4j-dev-help@ws.apache.org
Re: Can the location of the signature be controlled?
Posted by Fred Dushin <fr...@dushin.net>.
Do you mean that the SAML Assertion needs to be signed, or that the
signature over the message needs to be included in the SAML Assertion?
Generally, you won't be using WSS4J to sign a SAML Assertion (though
you could); instead, you'll typically get a signed Assertion from a
SAML authority, which is already signed.
Note also that you can't add an element to a previously signed
assertion without breaking a signature already over the assertion.
Can you say more about where you are obtaining your SAML Assertions
from?
Also, do you have any additional constraints that need to be applied
to the Assertion, as would apply to any of the SubjectConformation
methods in the SAML Assertion?
On Sep 16, 2007, at 9:27 AM, dstrower wrote:
>
> I am trying to sign a message with a SAML token. I am able to do
> this but the
> format looks like this:
> Security
> signature
> saml
>
> My server requires that the signature be inside the SAML assertion.
> Can I control where the signature is placed?
> --
> View this message in context: http://www.nabble.com/Can-the-
> location-of-the-signature-be-controlled--tf4451302.html#a12699525
> Sent from the WSS4J mailing list archive at Nabble.com.
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: wss4j-dev-unsubscribe@ws.apache.org
> For additional commands, e-mail: wss4j-dev-help@ws.apache.org
>
>
---------------------------------------------------------------------
To unsubscribe, e-mail: wss4j-dev-unsubscribe@ws.apache.org
For additional commands, e-mail: wss4j-dev-help@ws.apache.org
RE: Can the location of the signature be controlled?
Posted by George Stanchev <Gs...@serena.com>.
Hi David,
I am assuming you'd like to create a self-signed assertion.
You can use the opensaml 1.1 library already shipped with rampart/wss4j
to build
your assertion. With it you can sign it with your own key. Once you
build the
object, you can serialize to DOM and from there into AXIOM OMElement.
Then, to get it in the Security header, create your own security header
and add the saml to it as a child. Then add the header to the envelope
before invoking your web service. WSS4J would use your security header
to add the signature element.
Not sure about the ordering but I am assuming the signature will come
after the saml element:
Enevelope\Header\Security\saml
Enevelope\Header\Security\signature
Best Regards,
George
-----Original Message-----
From: dstrower [mailto:david.trower@alltel.com]
Sent: Sunday, September 16, 2007 7:28 AM
To: wss4j-dev@ws.apache.org
Subject: Can the location of the signature be controlled?
I am trying to sign a message with a SAML token. I am able to do this
but the format looks like this:
Security
signature
saml
My server requires that the signature be inside the SAML assertion.
Can I control where the signature is placed?
--
View this message in context:
http://www.nabble.com/Can-the-location-of-the-signature-be-controlled--t
f4451302.html#a12699525
Sent from the WSS4J mailing list archive at Nabble.com.
---------------------------------------------------------------------
To unsubscribe, e-mail: wss4j-dev-unsubscribe@ws.apache.org
For additional commands, e-mail: wss4j-dev-help@ws.apache.org
**********************************************************************
This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy all copies of the original message.
**********************************************************************
---------------------------------------------------------------------
To unsubscribe, e-mail: wss4j-dev-unsubscribe@ws.apache.org
For additional commands, e-mail: wss4j-dev-help@ws.apache.org