<div>hello,<br>Thanks to your kind reply. :)<br>The code piece is as follows, I think there is aready <X509Data/> in the <Signature/> part, it is not necessary to load the certificate.</div>
<div>Hope you can find something wrong in this code piece. :)</div>
<div> </div>
<div>Thanks a lot</div>
<div>Weizhong Qiang</div>
<div><br>******************************<br>bool SAMLToken::Authenticate(const std::string& cafile, const std::string& capath) {<br> xmlSecKeysMngr* keys_manager = NULL;<br> xmlSecDSigCtx *dsigCtx;<br><br> //Verify the signature under saml:assertion<br>
if((bool)x509data && (!cafile.empty() || !capath.empty())) {<br> keys_manager = <strong><em>load_trusted_certs</em></strong>(&keys_manager, cafile.c_str(), capath.c_str());<br> if(keys_manager == NULL) { std::cerr<<"Can not load trusted certificates"<<std::endl; return false; }<br>
}<br> else if((bool)x509data)<br> { std::cerr<<"No trusted certificates exists"<<std::endl; return false;}<br> if(keys_manager == NULL){ std::cerr<<"No <X509Data/> exists, or no trusted certificates configured"<<std::endl; return false;}<br>
<br> dsigCtx = xmlSecDSigCtxCreate(keys_manager);<br> if (xmlSecDSigCtxVerify(dsigCtx, assertion_signature_nd) < 0) {<br> xmlSecDSigCtxDestroy(dsigCtx);<br> if (keys_manager) xmlSecKeysMngrDestroy(keys_manager);<br>
std::cerr<<"Signature verification failed for saml:assertion"<<std::endl;<br> return false;<br> }<br> if(keys_manager != NULL)xmlSecKeysMngrDestroy(keys_manager);<br> if(dsigCtx->status == xmlSecDSigStatusSucceeded) {<br>
std::cout<<"Succeed to verify the signature in saml:assertion"<<std::endl;<br> xmlSecDSigCtxDestroy(dsigCtx);<br> }<br>}<br>else { std::cerr<<"Invalid signature in saml:assertion"<<std::endl; xmlSecDSigCtxDestroy(dsigCtx); return false; }<br>
}</div>
<div> </div>
<div> </div>
<div><strong><em>load_trusted_certs </em></strong>is as follows:</div>
<div> </div>
<div>
<p>//Load trusted cetificates into key manager<br>xmlSecKeysMngrPtr load_trusted_certs(xmlSecKeysMngrPtr* keys_manager, const char* cafile, const char* capath) {<br> xmlSecKeysMngrPtr keys_mngr;<br> if((keys_manager != NULL) && (*keys_manager != NULL)) keys_mngr = *keys_manager;<br>
else {<br> keys_mngr = xmlSecKeysMngrCreate();<br> //initialize keys manager<br> if (xmlSecCryptoAppDefaultKeysMngrInit(keys_mngr)<0) {<br> std::cerr<<"Can not initialize xmlSecKeysMngr object"<<std::endl;<br>
xmlSecKeysMngrDestroy(keys_mngr); return NULL;<br> }<br> }<br> if(keys_mngr == NULL) { std::cerr<<"Can not create xmlSecKeysMngr object"<<std::endl; return NULL;}</p>
<p> //load ca certs into keys manager, the two method used here could not work in some old xmlsec verion,<br> //because of some bug about X509_FILETYPE_DEFAULT and X509_FILETYPE_PEM<br> //load a ca path</p>
<p> if(!capath)<br> if(<em><strong>xmlSecOpenSSLAppKeysMngrAddCertsPath</strong></em>(keys_mngr, capath) < 0) {<br> xmlSecKeysMngrDestroy(keys_mngr);<br> return NULL;<br> }<br> //load a ca file TODO: can only be used in some new version of xmlsec<br>
if(!cafile)<br> if(<em><strong>xmlSecOpenSSLAppKeysMngrAddCertsFile</strong></em>(keys_mngr, cafile) < 0) {<br> xmlSecKeysMngrDestroy(keys_mngr);<br> return NULL;<br> }<br>}</p></div>
<div><br><br>On 7/15/08, Aleksey Sanin <<a href="mailto:aleksey@aleksey.com">aleksey@aleksey.com</a>> wrote:<br>> Well, I haven't seen your code so I have no idea what is wrong<br>> with it. You can take a look at what xmlsec command does and<br>
> then do copy/paste.<br>> <br>> <br>> Aleksey<br>> <br>> wz qiang wrote:<br>> > hello,<br>> > When I used the command line, I got the result which seems ok.<br>> > <br>> > xmlsec1 --verify --trusted-pem ca.pem --id-attr:AssertionID<br>
> > saml:Assertion assertion.xml<br>> > OK<br>> > SignedInfo References (ok/all): 1/1<br>> > Manifests References (ok/all): 0/0<br>> > <br>> > <br>> > Is there some hint?<br>> > <br>
> > Thanks a lot<br>> > Weizhong Qiang<br>> > <br>> > <br>> > On 7/15/08, Aleksey Sanin <<a href="mailto:aleksey@aleksey.com">aleksey@aleksey.com</a>> wrote:<br>> > <br>> > > Try to reproduce the problem using xmlsec1 command line tool<br>
> > > <br>> > > Aleksey<br>> > > <br>> > > <br>> > > wz qiang wrote:<br>> > > <br>> > > > hello,<br>> > > > I knew it is a openssl problem. :)<br>
> > > > But the strange thing is that the same certificate and ca certificate<br>> > > > works well when I use tls.<br>> > > > SSL_CTX_load_verify_locations(sslctx_,<br>> ca_file_.c_str(),<br>
> > > > <br>> > > NULL)<br>> > > <br>> > > > So I would know whether there is something wrong when I use xmlsec.<br>> > > > <br>> > > > Thanks<br>> > > > Weizhong Qiang<br>
> > > > <br>> > > > On 7/15/08, Aleksey Sanin <<a href="mailto:aleksey@aleksey.com">aleksey@aleksey.com</a>> wrote:<br>> > > > <br>> > > > <br>> > ><br>> <a href="http://www.mail-archive.com/openssl-users@openssl.org/msg45532.html">http://www.mail-archive.com/openssl-users@openssl.org/msg45532.html</a><br>
> > > <br>> > > > <br>> > > > > wz qiang wrote:<br>> > > > > <br>> > > > > <br>> > > > > > hi all,<br>> > > > > > I am doing some signature verification test with trusted<br>
> certificates.<br>> > > > > > I used<br>> > > > > > <br>> > > > > > <br>> > > > > <br>> > > > <br>> > ><br>> "xmlSecCryptoAppKeysMngrCertLoad(keys_mngr,<br>
> > > <br>> > > > <br>> > > > > ca_file,<br>> > > > > <br>> > > > > <br>> > > > > > xmlSecKeyDataFormatPem, xmlSecKeyDataTypeTrusted)" to load the ca<br>
> > > > > > certificate into keymanager, there is <X509Data/> under<br>> > > > > > <Signature><KeyInfo/></Signature>.<br>> > > > > > <br>> > > > > > But when I verify the signature (xmlSecDSigCtxVerify), I get the<br>
> > > > > > following error. The ca certificate is exactly the one which sign<br>> the<br>> > > > > > certificate under <X509Data/>.<br>> > > > > > And I also tried to use<br>
> > > > > > xmlSecOpenSSLAppKeysMngrAddCertsFile(keys_mngr,<br>> > > > > > <br>> > > > > <br>> > > > <br>> > > cafile)<br>> > > <br>> > > > <br>
> > > > > to load the<br>> > > > > <br>> > > > > <br>> > > > > > ca ceriticate, and got the same error.<br>> > > > > > Could somebody give some hint about sloving this problem?<br>
> > > > > > <br>> > > > > > <br>> > > > > > <br>> > > > > > <br>> > > > > <br>> > > > <br>> > ><br>> func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=360:obj=x509-store:subj=X509_verify_cert:error=4:crypto<br>
> > > <br>> > > > <br>> > > > > <br>> > > > > > library function<br>> > > > > > <br>> > > > > > <br>> > > > > <br>> > > > <br>
> > ><br>> failed:subj=/C=NO/ST=Oslo/O=UiO/CN=test;err=20;msg=unable<br>> > > <br>> > > > <br>> > > > > to get local<br>> > > > > <br>> > > > > <br>
> > > > > > issuer certificate<br>> > > > > > <br>> > > > > > <br>> > > > > > <br>> > > > > <br>> > > > <br>> > ><br>
> func=xmlSecOpenSSLX509StoreVerify:file=x509vfy.c:line=408:obj=x509-store:subj=unknown:error=71:certificate<br>> > > <br>> > > > <br>> > > > > <br>> > > > > > verification failed:err=20;msg=unable to get local issuer<br>
> certificate<br>> > > > > > <br>> > > > > > <br>> > > > > > <br>> > > > > <br>> > > > <br>> > ><br>> func=xmlSecKeysMngrGetKey:file=keys.c:line=1364:obj=unknown:subj=xmlSecKeysMngrFindKey:error=1:xmlsec<br>
> > > <br>> > > > <br>> > > > > <br>> > > > > > library function failed:<br>> > > > > > <br>> > > > > > <br>> > > > > > <br>
> > > > > <br>> > > > <br>> > ><br>> func=xmlSecDSigCtxProcessKeyInfoNode:file=xmldsig.c:line=871:obj=unknown:subj=unknown:error=45:key<br>> > > <br>> > > > <br>
> > > > > <br>> > > > > > is not found:<br>> > > > > > <br>> > > > > > <br>> > > > > > <br>> > > > > <br>> > > > <br>
> > ><br>> func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=565:obj=unknown:subj=xmlSecDSigCtxProcessKeyInfoNode:error=1:xmlsec<br>> > > <br>> > > > <br>> > > > > <br>
> > > > > > library function failed:<br>> > > > > > <br>> > > > > > <br>> > > > > > <br>> > > > > <br>> > > > <br>> > ><br>
> func=xmlSecDSigCtxVerify:file=xmldsig.c:line=366:obj=unknown:subj=xmlSecDSigCtxSigantureProcessNode:error=1:xmlsec<br>> > > <br>> > > > <br>> > > > > <br>> > > > > > library function failed:<br>
> > > > > > Signature verification failed for saml:assertion<br>> > > > > > <br>> > > > > > Thanks in advance<br>> > > > > > Weizhong Qiang<br>> > > > > > _______________________________________________<br>
> > > > > > xmlsec mailing list<br>> > > > > > <a href="mailto:xmlsec@aleksey.com">xmlsec@aleksey.com</a><br>> > > > > > <a href="http://www.aleksey.com/mailman/listinfo/xmlsec">http://www.aleksey.com/mailman/listinfo/xmlsec</a><br>
> > > > > > <br>> > > > > > <br>> > > > > > <br>> > > > > <br>> > > > _______________________________________________<br>> > > > xmlsec mailing list<br>
> > > > <a href="mailto:xmlsec@aleksey.com">xmlsec@aleksey.com</a><br>> > > > <a href="http://www.aleksey.com/mailman/listinfo/xmlsec">http://www.aleksey.com/mailman/listinfo/xmlsec</a><br>> > > > <br>
> > > > <br>> > > <br>> > _______________________________________________<br>> > xmlsec mailing list<br>> > <a href="mailto:xmlsec@aleksey.com">xmlsec@aleksey.com</a><br>> > <a href="http://www.aleksey.com/mailman/listinfo/xmlsec">http://www.aleksey.com/mailman/listinfo/xmlsec</a><br>
> > <br>> <br> </div>