15

When signing a SAML Response that also has a signed Assertion, should I:

A) Generate the Response signature without the Assertion signature. Then inject the Assertion signature after both signatures have been generated.

B) Generate the Assertion signature and include it when generating the Response signature.

C) Something else?

Duncan Jones
  • 67,400
  • 29
  • 193
  • 254
Panman
  • 1,157
  • 2
  • 8
  • 19

4 Answers4

44

SAML is awful, every time I read answer they are almost correct, here is the correct algorithm distilled:

  1. SHA1 the canonical version of the Assertion.
  2. Generate a SignedInfo XML fragment with the SHA1 signature
  3. Sign the SignedInfo XML fragment, again the canonical form
  4. Take the SignedInfo, the Signature and the key info and create a Signature XML fragment
  5. Insert this SignatureXML into the Assertion ( should go right before the saml:subject)
  6. Now take the assertion(with the signature included) and insert it into the Response
  7. SHA1 this response
  8. Generate a SignedInfo XML fragment with the SHA1 signature
  9. Sign the SignedInfo XML fragment, again the canonical form
  10. Take the SignedInfo, the Signature and the key info and create a Signature XML fragment
  11. Insert this SignatureXML into the Response
  12. Add the XML version info to the response.

Thats it. SAML is completely awful. There are tons of little subtleties that make implementing SAML a nightmare(like calculating the canonical form of a subset of the XML(the assertion), also the XML version of XML documents is not included.

I finished my implementation, I hope never to revisit such pain again.

PaulNUK
  • 4,774
  • 2
  • 30
  • 58
daniel
  • 9,732
  • 7
  • 42
  • 57
8

I believe the correct answer is B). Sign the Assertion first then sign the Response that contains the signed Assertion data. However, if a single Issuer/Entity (STS/IDP/etc) is signing both there is no real reason to sign the Assertion is there? Just sign the Protocol Message/Response which should include the Assertion data. This will cut down on processing requirements at the SP. For Web SSO, I've only ever seen both portions signed when you have a different entity signing the Assertion vs the Response.

Duncan Jones
  • 67,400
  • 29
  • 193
  • 254
Ian
  • 4,227
  • 18
  • 19
6

If you're signing both, then the assertion MUST be signed first, then the response, because the response signature will be based on the entire contents of the response (including the assertion signature). So signing the assertion second would invalidate the response signature.

JST
  • 1,154
  • 6
  • 15
0

The right answer is B.

If asserting party signs the SAML response using A, then the relying party must remove the signature of the SAML response and the signature of the SAML assertion before validating the SAML response. SAML Core Specification says that the signature must not be generated using transforms other than enveloped signature transform or exclusive canonicalization transform. None of these two transforms can remove the signature of the SAML assertion. Thus, the relying party cannot validate the SAML response.

fajarkoe
  • 1,543
  • 10
  • 12