4 ms·
The hardest part of SAML is the bonehead way in which they do signatures -- It normalizes the data before signing it, and then embeds the signature within the X
by matthewaveryusa 7y ago
The hardest part of SAML is the bonehead way in which they do signatures -- It normalizes the data before signing it, and then embeds the signature within the XML document.
So if you want to verify the authenticity of the identity assertion, you need to parse the XML, find the node that's being signed, canonicallize the node, and then finally verify the signature. It's absolutely gross to do and you need to use (lib)xmlsec1 lest you want to lose your sanity.
- captn3m0 7y agoI implemented XML Signatures at our org for Payments Interface (MPI) with Card Networks and there is a part of my brain that will forever curse me for reading the XMLDSig spec. How anyone ever thought XML Canonicalization was the right answer is beyond me.
- marcosdumay 7y agoXML being the way it is, I don't think there was any alternative to canonicalization.
- tomjen3 7y agoOf the top of my head: embed the XML as a pchar, sign only that; and the insert the signature as another XML value. Then you only parse the outside XML, extract the inner value and validate the signature, then you validate the inner value as-is, so no XML changes will undo the signature.
- marcosdumay 7y agoOk, you do not need to keep the signature at the same document you are signing. But you'll have to canonicalize your XML anyway. There are plenty of security issues with signing non-canonical XML.