[
https://issues.apache.org/jira/browse/CXF-5424?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13855765#comment-13855765
]
Sergey Beryozkin edited comment on CXF-5424 at 12/23/13 5:07 PM:
-----------------------------------------------------------------
The XML Signature specification mentions that KeyInfo is an optional element
and the application is expected to load it out of band if it is missing. IMHO
it is safe to provide a basic out-of-band mechanism, for example, use a default
crypto alias to load a certificate which can be used to validate a signature, a
minor positive is that the processing should be faster too.
In case of non-SAML2 payloads, for example, when we have the XML signature
added only, we can try using the authenticated user name as the alias or the
default crypto alias to load a certificate.
In case of RACS we can only try a default crypto alias; we can also extend that
if needed to use the subject names as aliases however I'm not sure it is
practical yet, in this case it is really an IDP certificate that we need. I
guess this implies RACS will need its own signature crypto - which seems
reasonable.
was (Author: sergey_beryozkin):
The XML Signature specification mentions that KeyInfo is an optional element
and the application is expected to load it out of band if it is missing. IMHO
it is safe to provide a basic out-of-band mechanism, for example, use a default
crypto alias to load a certificate which can be used to validate a signature, a
minor positive is that the processing should be faster too.
In case of non-SAML2 payloads, for example, when we have the XML signature
added only, we can try use the authenticated user as the alias or the default
crypto alias to load a certificate.
In case of RACS we can only try a default crypto alias; we cam also extend that
if needed to use the subject names as aliases however I'm not sure it is
practical yet, in this case it is really an IDP certificate that we need. I
guess this implies RACS will need its own signature crypto - which seems
reasonable.
> JAX-RS Security Code can not validate signed SAML2 bearer assertions without
> KeyInfo
> ------------------------------------------------------------------------------------
>
> Key: CXF-5424
> URL: https://issues.apache.org/jira/browse/CXF-5424
> Project: CXF
> Issue Type: Bug
> Components: JAX-RS Security
> Reporter: Sergey Beryozkin
>
> Signed SAML2 Bearer assertions may not always have XML Signature KeyInfo
> elements available. The JAX-RS security code fails to validate such
> assertions but it should be able to *optionally* validate them without
> KeyInfo
--
This message was sent by Atlassian JIRA
(v6.1.5#6160)
