Signature did not validate against the credential's key

Question

I have a saml response from idp, it is signed in both response and assertions. I am trying to validate the signature using the X509 certificate a public key. This is my code

public class SamlTest {

public static void main(String[] args) throws Exception {

    // read the file
    File file = new File("filepath");   
    FileReader fileReader = new FileReader(file);
    BufferedReader bf = new BufferedReader(fileReader);
    String str;
    String samlStr = "";
    while ((str = bf.readLine()) != null) {
        samlStr += str;
    }

    Response response = SamlTest.unmarshall(samlStr);

    SAMLSignatureProfileValidator profileValidator = new SAMLSignatureProfileValidator();
    try {
        profileValidator.validate(response.getSignature());
    } catch (ValidationException e) {
        System.out.println("ErrorString [Error in SAMLSignatureProfilValidation]");
    }

    Certificate certificate = SamlTest.getCertificate(response.getSignature());

    BasicCredential verificationCredential = new BasicCredential();
    verificationCredential.setPublicKey(certificate.getPublicKey());


    SignatureValidator sigValidator = new SignatureValidator(verificationCredential);
    try {
        sigValidator.validate(response.getSignature());
    } catch (ValidationException e) {
        e.printStackTrace();
    }
}

private static Response unmarshall(String samlStr) throws Exception {

    DefaultBootstrap.bootstrap();
    DocumentBuilderFactory documentBuilderFactory = DocumentBuilderFactory.newInstance();
    documentBuilderFactory.setNamespaceAware(true);
    DocumentBuilder docBuilder = documentBuilderFactory.newDocumentBuilder();

    ByteArrayInputStream byteArrayInputStream = new ByteArrayInputStream(samlStr.getBytes());

    Document document = docBuilder.parse(byteArrayInputStream);

    Element element = document.getDocumentElement();
    UnmarshallerFactory unmarshallerFactory = Configuration.getUnmarshallerFactory();
    Unmarshaller unmarshaller = unmarshallerFactory.getUnmarshaller(element);

}

private static Certificate getCertificate(Signature signature) {
    try {
        X509Certificate certificate = signature.getKeyInfo().getX509Datas().get(0).getX509Certificates().get(0);

        if (certificate != null) {
            //Converts org.opensaml.xml.signature.X509Certificate to java.security.cert.Certificate
            String lexicalXSDBase64Binary = certificate.getValue();
            byte[] decoded = DatatypeConverter.parseBase64Binary(lexicalXSDBase64Binary);

            try {
                CertificateFactory certFactory = CertificateFactory.getInstance("X.509");
                Certificate cert = certFactory.generateCertificate(new ByteArrayInputStream(decoded));
                System.out.println(cert);
                return cert;
            } catch (CertificateException e) {
                //this should never happen
                System.out.println("SAML Signature issue");
                return null;
            }
        }
        return null; // TODO Auto-generated method stub

    } catch (NullPointerException e) {
        //Null certificates

        return null;
    }
}}

I have tried multiple saml responses, not just mine. But I get an error saying:

WARN org.apache.xml.security.signature.XMLSignature - Signature verification failed. org.opensaml.xml.validation.ValidationException: Signature did not validate against the credential's key

This question has been asked before but there never has been a clear answer so asking again.

Example of a saml response I am trying to test is the following:



http://idp.example.com/metadata.php

    
        
        
        
            
                
                
            
            
            omD68BGTOD4rSkKgo3zHEz2D0Ak=
        
    
    
        C+QerLk231g7kSvB/Bo+JrfdYHrzqt+3ql0+WqBIOPRx7xHHvvSx1GiUyDncs7x+LnldDHb/jU8V1Bay+mHKaKB2GnL06XZW33vK/z5GsVLzIF7h9mfybRrbFwdOPYNQzHgnGxWDp3LsehzL58cRXtu2V+aLbYRB0e3wI6tcpBY=
    
    
        
            
                MIICajCCAdOgAwIBAgIBADANBgkqhkiG9w0BAQ0FADBSMQswCQYDVQQGEwJ1czETMBEGA1UECAwKQ2FsaWZvcm5pYTEVMBMGA1UECgwMT25lbG9naW4gSW5jMRcwFQYDVQQDDA5zcC5leGFtcGxlLmNvbTAeFw0xNDA3MTcxNDEyNTZaFw0xNTA3MTcxNDEyNTZaMFIxCzAJBgNVBAYTAnVzMRMwEQYDVQQIDApDYWxpZm9ybmlhMRUwEwYDVQQKDAxPbmVsb2dpbiBJbmMxFzAVBgNVBAMMDnNwLmV4YW1wbGUuY29tMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDZx+ON4IUoIWxgukTb1tOiX3bMYzYQiwWPUNMp+Fq82xoNogso2bykZG0yiJm5o8zv/sd6pGouayMgkx/2FSOdc36T0jGbCHuRSbtia0PEzNIRtmViMrt3AeoWBidRXmZsxCNLwgIV6dn2WpuE5Az0bHgpZnQxTKFek0BMKU/d8wIDAQABo1AwTjAdBgNVHQ4EFgQUGHxYqZYyX7cTxKVODVgZwSTdCnwwHwYDVR0jBBgwFoAUGHxYqZYyX7cTxKVODVgZwSTdCnwwDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQ0FAAOBgQByFOl+hMFICbd3DJfnp2Rgd/dqttsZG/tyhILWvErbio/DEe98mXpowhTkC04ENprOyXi7ZbUqiicF89uAGyt1oqgTUCD1VsLahqIcmrzgumNyTwLGWo17WDAa1/usDhetWAMhgzF/Cnf5ek0nK00m0YZGyc4LzgD0CROMASTWNg==
            
        
    


    


    http://idp.example.com/metadata.php
    
        
            
            
            
                
                    
                    
                
                
                ui6giJBmDP2ShSBq06MQ/hVkK6U=
            
        
        
            eG/U9aPs3WJjgLQwPJF+liaPVAngVXkonmLxVEmTRa01sivZboNZr+5xgNMqqXjOHsuMfpA9sCJi/Iv3u4g2YEyamo3DxdPG2h/Qx9lcA3hjKIhkKIicqCbwZhMsKupZs71FmvJCKS/MrzNiZJWxtjtCD+Rn3CpWhXPCz4vzfj8=
        
        
            
                
                    MIICajCCAdOgAwIBAgIBADANBgkqhkiG9w0BAQ0FADBSMQswCQYDVQQGEwJ1czETMBEGA1UECAwKQ2FsaWZvcm5pYTEVMBMGA1UECgwMT25lbG9naW4gSW5jMRcwFQYDVQQDDA5zcC5leGFtcGxlLmNvbTAeFw0xNDA3MTcxNDEyNTZaFw0xNTA3MTcxNDEyNTZaMFIxCzAJBgNVBAYTAnVzMRMwEQYDVQQIDApDYWxpZm9ybmlhMRUwEwYDVQQKDAxPbmVsb2dpbiBJbmMxFzAVBgNVBAMMDnNwLmV4YW1wbGUuY29tMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDZx+ON4IUoIWxgukTb1tOiX3bMYzYQiwWPUNMp+Fq82xoNogso2bykZG0yiJm5o8zv/sd6pGouayMgkx/2FSOdc36T0jGbCHuRSbtia0PEzNIRtmViMrt3AeoWBidRXmZsxCNLwgIV6dn2WpuE5Az0bHgpZnQxTKFek0BMKU/d8wIDAQABo1AwTjAdBgNVHQ4EFgQUGHxYqZYyX7cTxKVODVgZwSTdCnwwHwYDVR0jBBgwFoAUGHxYqZYyX7cTxKVODVgZwSTdCnwwDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQ0FAAOBgQByFOl+hMFICbd3DJfnp2Rgd/dqttsZG/tyhILWvErbio/DEe98mXpowhTkC04ENprOyXi7ZbUqiicF89uAGyt1oqgTUCD1VsLahqIcmrzgumNyTwLGWo17WDAa1/usDhetWAMhgzF/Cnf5ek0nK00m0YZGyc4LzgD0CROMASTWNg==
                
            
        
    
    
        
            _ce3d2948b4cf20146dee0a0b3dd6f69b6cf86f62d7
        
        
            
        
    
    
        
            http://sp.example.com/demo1/metadata.php
        
    
    
        
            urn:oasis:names:tc:SAML:2.0:ac:classes:Password
        
    
    
        
            test
        
        
            test@example.com
        
        
            users
            examplerole1

Please let me know if anyone can spot an issue. Thanks a lot!

Signature did not validate against the credential's key

Answers (1)

Related Questions

Signature did not validate against the credential&#39;s key

Answers (1)

Related Questions

Signature did not validate against the credential's key