<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">Hello,<div class=""><br class=""></div><div class="">Thanks Aleksey and Timothy for helping.</div><div class=""><br class=""></div><div class="">The issue was that I've used a simple key pair instead of a (self) signed certificate. I should have thought about it before.</div><div class=""><br class=""></div><div class="">Those two questions put be on tracks specifying x509</div><div class=""><br class=""></div><div class=""><br class=""></div><div class=""><blockquote type="cite" class=""><div class="">Le 3 juil. 2022 à 02:54, Aleksey Sanin <<a href="mailto:aleksey@aleksey.com" class="">aleksey@aleksey.com</a>> a écrit :</div><br class="Apple-interchange-newline"><div class=""><div dir="auto" class="">BTW, did you submit the trusted IdP X509 certificate to the samltool?<div class=""><br class=""></div><div class=""><a href="https://www.samltool.com/validate_response.php" class="">https://www.samltool.com/validate_response.php</a></div></div></div></blockquote></div><div class=""><br class=""></div><div class=""><br class=""></div><div class=""><div dir="auto" class=""><div class=""><br class=""></div><div class=""><br class=""></div></div></div><div class=""><div class=""><blockquote type="cite" class=""><div class="">Le 3 juil. 2022 à 04:09, Timothy Legge <<a href="mailto:timlegge@gmail.com" class="">timlegge@gmail.com</a>> a écrit :</div><div class=""><br class=""></div></blockquote><blockquote type="cite" class="">I tested against perl's XML::Sig and that was the result.<br class="">It is likely possible to validate if I had the public certificate in<br class="">PEM format (not the public key itself).<br class=""><br class=""><a href="https://www.samltool.com/validate_response.php" class="">https://www.samltool.com/validate_response.php</a> requires the public<br class="">certificate to validate against.</blockquote></div></div><div class=""><br class=""></div><div class=""><br class=""></div><div class=""><br class=""></div><div class="">For the records and to help other users, answers below to the other parts of your messages:</div><div class=""><br class=""></div><div class=""><div class=""><div dir="ltr" class=""><blockquote type="cite" class="">On Jul 2, 2022, at 8:43 PM, Aleksey Sanin <<a href="mailto:aleksey@aleksey.com" class="">aleksey@aleksey.com</a>> wrote:<br class=""><br class=""></blockquote></div><blockquote type="cite" class=""><div dir="ltr" class="">What error(s) do you get from these tools?<br class=""></div></blockquote></div></div><div class=""><br class=""></div><div class="">From samltest I get this:</div><div class=""><br class=""></div><div class=""><div class=""><pre style="font-variant-ligatures: normal; orphans: 2; widows: 2; text-decoration-thickness: initial; overflow-wrap: break-word; white-space: pre-wrap;" class="">2022-07-02 23:07:56 DEBUG OpenSAML.MessageDecoder.SAML2 [73237] [default]: extracting issuer from SAML 2.0 protocol message
2022-07-02 23:07:56 DEBUG OpenSAML.MessageDecoder.SAML2 [73237] [default]: message from (<a href="http://127.0.0.1:8080/saml/sso" class="">http://127.0.0.1:8080/saml/sso</a>)
2022-07-02 23:07:56 DEBUG OpenSAML.MessageDecoder.SAML2 [73237] [default]: searching metadata for message issuer...
2022-07-02 23:07:56 DEBUG OpenSAML.MessageDecoder.SAML2 [73237] [default]: recovered request/response correlation value (_282e31dacdbbdd363615c3fe8a207991)
2022-07-02 23:07:56 DEBUG OpenSAML.SecurityPolicyRule.MessageFlow [73237] [default]: evaluating message flow policy (correlation off, replay checking on, expiration 60)
2022-07-02 23:07:56 DEBUG OpenSAML.SecurityPolicyRule.MessageFlow [73237] [default]: ignoring InResponseTo, correlation checking is disabled
2022-07-02 23:07:56 DEBUG XMLTooling.StorageService [73237] [default]: inserted record (_D6906242-34B2-4441-8467-63FDB8D11EA5) in context (MessageFlow) with expiration (1656803511)
2022-07-02 23:07:56 DEBUG OpenSAML.SecurityPolicyRule.XMLSigning [73237] [default]: validating signature profile
2022-07-02 23:07:56 WARN OpenSAML.SecurityPolicyRule.XMLSigning [73237] [default]: unable to verify message signature with supplied trust engine
2022-07-02 23:07:56 WARN Shibboleth.SSO.SAML2 [73237] [default]: error processing incoming assertion: Message was signed, but signature could not be verified.</pre><div class=""><br class=""></div></div><div class="">And from sameltool:</div><div class=""><br class=""></div><div class="">Response signature validation failed.<br class=""><br class=""></div><div class=""><br class=""></div></div><div class=""><div class=""><blockquote type="cite" class="">Le 3 juil. 2022 à 02:54, Aleksey Sanin <<a href="mailto:aleksey@aleksey.com" class="">aleksey@aleksey.com</a>> a écrit :</blockquote></div><div class=""><blockquote type="cite" class=""><div dir="auto" class=""><div class=""><br class=""></div></div></blockquote></div><div class=""><blockquote type="cite" class=""><div dir="auto" class=""><div class="">You also probably want to put KeyInfo with X509 cert (or full certs chain) for the private key used for signing into the signature itself.</div></div></blockquote></div></div><div class=""><br class=""></div><div class="">&</div><div class=""><br class=""></div><div class=""><blockquote type="cite" class=""><div class="">Le 3 juil. 2022 à 04:09, Timothy Legge <<a href="mailto:timlegge@gmail.com" class="">timlegge@gmail.com</a>> a écrit :</div><div class=""><br class="">The SamlResponse does not include a key type or KeyInfo in the<br class="">document. </div></blockquote></div><div class=""><div class=""><br class=""></div></div><div class=""><br class=""></div><div class="">Regarding the KeyInfo part, it's optional in SAML, we are supposed to provide this public key by another method before the first use. Usually with a metadata exchange between SP and IDP that happen over HTTPS.</div><div class=""><br class=""></div><div class="">The signature key doesn't have to be signed by an authority in SAML due to that point. The metadata exchange happens over a valid HTTPS stream which then gives the trust to the keys.</div><div class=""><br class=""></div><div class="">But as learned today, it has to be actual certificates, not just public keys, even if self signed.</div><div class=""><br class=""></div></body></html>