<div>xmlsec output:</div><div><br></div><div><div>OK</div><div>SignedInfo References (ok/all): 1/1</div><div>Manifests References (ok/all): 0/0</div><div>= VERIFICATION CONTEXT</div><div>== Status: succeeded</div><div>== flags: 0x00000006</div>
<div>== flags2: 0x00000000</div><div>== Key Info Read Ctx:</div><div>= KEY INFO READ CONTEXT</div><div>== flags: 0x00000000</div><div>== flags2: 0x00000000</div><div>== enabled key data: all</div><div>== RetrievalMethod level (cur/max): 0/1</div>
<div>== TRANSFORMS CTX (status=0)</div><div>== flags: 0x00000000</div><div>== flags2: 0x00000000</div><div>== enabled transforms: all</div><div>=== uri: NULL</div><div>=== uri xpointer expr: NULL</div><div>== EncryptedKey level (cur/max): 0/1</div>
<div>=== KeyReq:</div><div>==== keyId: rsa</div><div>==== keyType: 0x00000001</div><div>==== keyUsage: 0x00000002</div><div>==== keyBitsSize: 0</div><div>=== list size: 0</div><div>== Key Info Write Ctx:</div><div>= KEY INFO WRITE CONTEXT</div>
<div>== flags: 0x00000000</div><div>== flags2: 0x00000000</div><div>== enabled key data: all</div><div>== RetrievalMethod level (cur/max): 0/1</div><div>== TRANSFORMS CTX (status=0)</div><div>== flags: 0x00000000</div><div>
== flags2: 0x00000000</div><div>== enabled transforms: all</div><div>=== uri: NULL</div><div>=== uri xpointer expr: NULL</div><div>== EncryptedKey level (cur/max): 0/1</div><div>=== KeyReq:</div><div>==== keyId: NULL</div>
<div>==== keyType: 0x00000001</div><div>==== keyUsage: 0xffffffff</div><div>==== keyBitsSize: 0</div><div>=== list size: 0</div><div>== Signature Transform Ctx:</div><div>== TRANSFORMS CTX (status=2)</div><div>== flags: 0x00000000</div>
<div>== flags2: 0x00000000</div><div>== enabled transforms: all</div><div>=== uri: NULL</div><div>=== uri xpointer expr: NULL</div><div>=== Transform: exc-c14n (href=<a href="http://www.w3.org/2001/10/xml-exc-c14n#">http://www.w3.org/2001/10/xml-exc-c14n#</a>)</div>
<div>=== Transform: rsa-sha1 (href=<a href="http://www.w3.org/2000/09/xmldsig#rsa-sha1">http://www.w3.org/2000/09/xmldsig#rsa-sha1</a>)</div><div>=== Transform: membuf-transform (href=NULL)</div><div>== Signature Method:</div>
<div>=== Transform: rsa-sha1 (href=<a href="http://www.w3.org/2000/09/xmldsig#rsa-sha1">http://www.w3.org/2000/09/xmldsig#rsa-sha1</a>)</div><div>== Signature Key:</div><div>== KEY</div><div>=== method: RSAKeyValue</div><div>
=== key type: Public</div><div>=== key usage: -1</div><div>=== rsa key: size = 1024</div><div>=== list size: 1</div><div>=== X509 Data:</div><div>==== Certificate:</div><div>==== Subject Name: /C=US/ST=TN/L=Nashville/O=Emdeon/OU=Emdeon/CN=Emdeon</div>
<div>==== Issuer Name: /C=US/ST=TN/L=Nashville/O=Emdeon/OU=Emdeon/CN=Emdeon</div><div>==== Issuer Serial: 4CAB2D3B</div><div>== SignedInfo References List:</div><div>=== list size: 1</div><div>= REFERENCE VERIFICATION CONTEXT</div>
<div>== Status: succeeded</div><div>== URI: "#Response-guid-ab3e423b-4f6e-4376-b910-553b31bc6404"</div><div>== Reference Transform Ctx:</div><div>== TRANSFORMS CTX (status=2)</div><div>== flags: 0x00000000</div>
<div>== flags2: 0x00000000</div><div>== enabled transforms: all</div><div>=== uri: </div><div>=== uri xpointer expr: #Response-guid-ab3e423b-4f6e-4376-b910-553b31bc6404</div><div>=== Transform: xpointer (href=<a href="http://www.w3.org/2001/04/xmldsig-more/xptr">http://www.w3.org/2001/04/xmldsig-more/xptr</a>)</div>
<div>=== Transform: enveloped-signature (href=<a href="http://www.w3.org/2000/09/xmldsig#enveloped-signature">http://www.w3.org/2000/09/xmldsig#enveloped-signature</a>)</div><div>=== Transform: exc-c14n (href=<a href="http://www.w3.org/2001/10/xml-exc-c14n#">http://www.w3.org/2001/10/xml-exc-c14n#</a>)</div>
<div>=== Transform: membuf-transform (href=NULL)</div><div>=== Transform: sha1 (href=<a href="http://www.w3.org/2000/09/xmldsig#sha1">http://www.w3.org/2000/09/xmldsig#sha1</a>)</div><div>=== Transform: membuf-transform (href=NULL)</div>
<div>== Digest Method:</div><div>=== Transform: sha1 (href=<a href="http://www.w3.org/2000/09/xmldsig#sha1">http://www.w3.org/2000/09/xmldsig#sha1</a>)</div><div>== PreDigest data - start buffer:</div><div><Response xmlns="urn:oasis:names:tc:SAML:1.0:protocol" xmlns:saml="urn:oasis:names:tc:SAML:1.0:assertion" xmlns:samlp="urn:oasis:names:tc:SAML:1.0:protocol" xmlns:xsd="<a href="http://www.w3.org/2001/XMLSchema">http://www.w3.org/2001/XMLSchema</a>" xmlns:xsi="<a href="http://www.w3.org/2001/XMLSchema-instance">http://www.w3.org/2001/XMLSchema-instance</a>" IssueInstant="2010-10-06T21:15:38.906Z" MajorVersion="1" MinorVersion="1" Recipient="<a href="http://amgr.emdeon.com">http://amgr.emdeon.com</a>" ResponseID="Response-guid-ab3e423b-4f6e-4376-b910-553b31bc6404"><Status><StatusCode Value="samlp:Success"></StatusCode></Status><Assertion xmlns="urn:oasis:names:tc:SAML:1.0:assertion" AssertionID="kpenti-df8fac42-ac9d-4317-98c4-7c05fc4bb761" IssueInstant="2010-10-06T16:15:38.906Z" Issuer="<a href="http://access.emdeon.com">http://access.emdeon.com</a>" MajorVersion="1" MinorVersion="1"><Conditions NotBefore="2010-10-06T21:15:38.905Z" NotOnOrAfter="2010-10-06T21:25:38.905Z"></Conditions><AuthenticationStatement AuthenticationInstant="2010-10-06T16:15:38.906Z" AuthenticationMethod="urn:oasis:names:tc:1.0:am:password"><Subject><NameIdentifier>kpenti</NameIdentifier><SubjectConfirmation><ConfirmationMethod>urn:oasis:names:tc:1.0:cm:bearer</ConfirmationMethod></SubjectConfirmation></Subject></AuthenticationStatement></Assertion></Response></div>
<div>== PreDigest data - end buffer</div><div>== Manifest References List:</div><div>=== list size: 0</div></div><br><br><div class="gmail_quote">On Wed, Oct 13, 2010 at 7:28 AM, Aleksey Sanin <span dir="ltr"><<a href="mailto:aleksey@aleksey.com">aleksey@aleksey.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">What is the output of the xmlsec1 command?<br>
<br>
Aleksey<div><div></div><div class="h5"><br>
<br>
On 10/12/10 11:36 PM, Erik Smith wrote:<br>
</div></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div><div></div><div class="h5">
After I call xmlSecDSigCtxVerify, the status in the contex is corrupted<br>
with a large number. However xmlsec1 reports validation as OK.<br>
<br>
xmlsec1 --verify --pubkey-cert-pem cert.crt --store-references<br>
--id-attr:ResponseID urn:oasis:names:tc:SAML:1.0:protocol:Response /saml.xml<br>
<br>
Also xmlSecDSigCtxDebugDump output is exactly the same for xmlsec1 and<br>
my program.<br>
<br>
I've reduced the code down to what is below and I'm having trouble<br>
seeing what could be wrong.<br>
<br>
libxml version: 2.6.27<br>
xmlsec version: 1.2.11<br>
<br>
Thanks for any help.<br>
<br>
<br>
<br>
#include <iostream><br>
#include <xmlsec/xmltree.h><br>
#include <xmlsec/xmldsig.h><br>
#include <xmlsec/crypto.h><br>
#include <xmlsec/errors.h><br>
<br>
#ifndef XMLSEC_NO_XSLT<br>
#include <libxslt/xslt.h><br>
#endif<br>
<br>
void error(const char *);<br>
<br>
int main(int argc, char **argv) {<br>
using namespace std;<br>
int status(0);<br>
<br>
xmlSecKeysMngrPtr mngr_;<br>
xmlSecDSigCtxPtr dsigCtx;<br>
xmlDocPtr doc_;<br>
<br>
cout << "libxml version: " << LIBXML_DOTTED_VERSION << endl;<br>
cout << "xmlsec version: " << XMLSEC_VERSION << endl;<br>
<br>
xmlInitParser();<br>
LIBXML_TEST_VERSION;<br>
xmlLoadExtDtdDefaultValue = XML_DETECT_IDS | XML_COMPLETE_ATTRS;<br>
xmlSubstituteEntitiesDefault(1);<br>
<br>
#ifndef XMLSEC_NO_XSLT<br>
xmlIndentTreeOutput = 1;<br>
#endif<br>
// Init xmlsec library<br>
if (xmlSecInit() < 0) error("xmlSecInit");<br>
if (xmlSecCheckVersion() != 1) error("xmlSecCheckVersion");<br>
<br>
#ifdef XMLSEC_CRYPTO_DYNAMIC_LOADING<br>
if(xmlSecCryptoDLLoadLibrary(BAD_CAST "openssl") < 0)<br>
error("xmlSecCryptoDLLoadLibrary");<br>
#endif<br>
<br>
if(xmlSecCryptoAppInit(NULL) < 0) error("Error: crypto<br>
initialization failed.");<br>
if(xmlSecCryptoInit() < 0) error("Error: xmlsec-crypto<br>
initialization failed.");<br>
<br>
mngr_ = xmlSecKeysMngrCreate();<br>
if (!mngr_) error("bad");<br>
<br>
if (xmlSecCryptoAppDefaultKeysMngrInit(mngr_) < 0) error("bad");<br>
<br>
xmlSecKeyDataFormat format(xmlSecKeyDataFormatCertPem);<br>
xmlSecKeyPtr key = xmlSecCryptoAppKeyLoad("cert.crt", format, NULL,<br>
NULL, NULL);<br>
if (!key) error("key load error");<br>
<br>
if(xmlSecCryptoAppDefaultKeysMngrAdoptKey(mngr_, key) < 0)<br>
error("could not add key");<br>
<br>
doc_ = xmlParseFile("saml.xml");<br>
if (!doc_ || !xmlDocGetRootElement(doc_)) error("bad");<br>
<br>
set_id(doc_);<br>
<br>
xmlNodePtr node = xmlSecFindNode(xmlDocGetRootElement(doc_),<br>
xmlSecNodeSignature, xmlSecDSigNs);<br>
if (!node) error("start node not found");<br>
<br>
dsigCtx = xmlSecDSigCtxCreate(mngr_);<br>
if (!dsigCtx) error("failed to create signature context");<br>
<br>
std::cout << "status before: " << dsigCtx->status << std::endl;<br>
if (xmlSecDSigCtxVerify(dsigCtx, node) < 0) error("signature verify<br>
error");<br>
std::cout << "status: " << dsigCtx->status << std::endl;<br>
//xmlSecDSigCtxDebugDump(dsigCtx, stdout);<br>
<br>
return status;<br>
}<br>
<br>
void set_id(xmlDocPtr doc) {<br>
using namespace std;<br>
<br>
xmlNodePtr node = xmlSecFindNode(<br>
xmlDocGetRootElement(doc),<br>
BAD_CAST "Response",<br>
BAD_CAST "urn:oasis:names:tc:SAML:1.0:protocol");<br>
<br>
cout << "element name: " << node->name<< endl;<br>
xmlAttrPtr attr = xmlHasProp(node, BAD_CAST "ResponseID");<br>
if (!attr) error("attribute not found");<br>
cout << "attribute name: " << attr->name<< endl;<br>
<br>
xmlChar *value = xmlNodeListGetString(node->doc, attr->children, 1);<br>
if (!value) error("xmlNodeListGetString");<br>
cout << "value: " << value << endl;<br>
<br>
xmlAttrPtr tmp(xmlGetID(node->doc, value));<br>
if (tmp) {<br>
cout << "id already registered" << endl;<br>
} else {<br>
xmlIDPtr id = xmlAddID(NULL, doc, BAD_CAST value, attr);<br>
if (!id) {<br>
xmlFree(value); // fix<br>
error("xmlAddID error");<br>
}<br>
cout << "id added" << endl;<br>
}<br>
<br>
//xmlFree(value); // fix<br>
}<br>
<br>
void error(const char *e) {<br>
std::cout << e << std::endl;<br>
std::cout << "exiting" << std::endl;<br>
exit(0);<br>
}<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br></div></div>
_______________________________________________<br>
xmlsec mailing list<br>
<a href="mailto:xmlsec@aleksey.com" target="_blank">xmlsec@aleksey.com</a><br>
<a href="http://www.aleksey.com/mailman/listinfo/xmlsec" target="_blank">http://www.aleksey.com/mailman/listinfo/xmlsec</a><br>
</blockquote>
</blockquote></div><br>