xmlsec1 --verify test.xml
我正在跟踪堆栈跟踪:
func=xmlSecXPathDataExecute:file=xpath.c:line=273:obj=unkNown:subj=xmlXPtrEval:error=5:libxml2 library function Failed:expr=xpointer(id(‘uuid-73c06e86-88d2-4204-91f4-3d484bc782cc’))
func=xmlSecXPathDataListExecute:file=xpath.c:line=373:obj=unkNown:subj=xmlSecXPathDataExecute:error=1:xmlsec library function Failed:
func=xmlSecTransformXPathExecute:file=xpath.c:line=483:obj=xpointer:subj=xmlSecXPathDataExecute:error=1:xmlsec library function Failed:
func=xmlSecTransformDefaultPushXml:file=transforms.c:line=2411:obj=xpointer:subj=xmlSecTransformExecute:error=1:xmlsec library function Failed:
func=xmlSecTransformCtxXmlExecute:file=transforms.c:line=1242:obj=unkNown:subj=xmlSecTransformpushXml:error=1:xmlsec library function Failed:transform=xpointer
func=xmlSecTransformCtxExecute:file=transforms.c:line=1302:obj=unkNown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library function Failed:
func=xmlSecDSigReferenceCtxProcessNode:file=xmldsig.c:line=1589:obj=unkNown:subj=xmlSecTransformCtxExecute:error=1:xmlsec library function Failed:
func=xmlSecDSigCtxProcessSignedInfoNode:file=xmldsig.c:line=822:obj=unkNown:subj=xmlSecDSigReferenceCtxProcessNode:error=1:xmlsec library function Failed:node=Reference
func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=563:obj=unkNown:subj=xmlSecDSigCtxProcessSignedInfoNode:error=1:xmlsec library function Failed:
func=xmlSecDSigCtxVerify:file=xmldsig.c:line=382:obj=unkNown:subj=xmlSecDSigCtxSignatureProcessNode:error=1:xmlsec library function Failed:
Error: signature Failed
ERROR
SignedInfo References (ok/all): 0/1
Manifests References (ok/all): 0/0
Error: Failed to verify file “test.xml”
“`
基于堆栈跟踪,我认为ID有问题.经过一番挖掘,我发现了执行
xmlsec1 --verify --id-attr:ID "urn:oasis:names:tc:SAML:2.0:protocol:Response" test.xml
产生以下堆栈跟踪
func=xmlSecopenSSLEvpDigestVerify:file=digests.c:line=249:obj=sha1:subj=unkNown:error=12:invalid data:data and digest do not match
FAIL
SignedInfo References (ok/all): 0/1
Manifests References (ok/all): 0/0
Error: Failed to verify file “test.xml”
<saml2p:Response xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol" Destination="http://localhost/login" ID="uuid-73c06e86-88d2-4204-91f4-3d484bc782cc" InResponseto="_bbaf45ef713be7a8c8701e41118ec2278cbf32828f" IssueInstant="2016-02-29T14:16:31.142Z" Version="2.0"> <saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">idp-name</saml2:Issuer> <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#"> <ds:SignedInfo> <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /> <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /> <ds:Reference URI="#uuid-73c06e86-88d2-4204-91f4-3d484bc782cc"> <ds:Transforms> <ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /> <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /> </ds:Transforms> <ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /> <ds:DigestValue>H9ffPJ6/jq25p13BcziR0hNLkGg=</ds:DigestValue> </ds:Reference> </ds:SignedInfo> <ds:SignatureValue>FegjeG..pJEQ==</ds:SignatureValue> <ds:KeyInfo> <ds:X509Data> <ds:X509Certificate>MIIFIj..mV7A==</ds:X509Certificate> </ds:X509Data> <ds:X509Data> <ds:X509Certificate>MIIFDj..5uLcw=</ds:X509Certificate> </ds:X509Data> <ds:X509Data> <ds:X509Certificate>MIIE/z..3IDhA=</ds:X509Certificate> </ds:X509Data> <ds:X509Data> <ds:X509Certificate>MIIEkT..h5/WrQ8</ds:X509Certificate> </ds:X509Data> </ds:KeyInfo> </ds:Signature> <saml2:Assertion xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion" ID="uuid-201bfc86-e7d7-4dca-bdb5-2263b2d27c22" IssueInstant="2016-02-29T14:16:01.175Z" Version="2.0"> <saml2:Issuer>idp-name</saml2:Issuer> <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#"> <ds:SignedInfo> <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /> <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /> <ds:Reference URI="#uuid-201bfc86-e7d7-4dca-bdb5-2263b2d27c22"> <ds:Transforms> <ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /> <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /> </ds:Transforms> <ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /> <ds:DigestValue>EJzD3pVZwkvFkh8IX0xyF7tmP2k=</ds:DigestValue> </ds:Reference> </ds:SignedInfo> <ds:SignatureValue>b3ONeh..zOEw==</ds:SignatureValue> <ds:KeyInfo> <ds:X509Data> <ds:X509Certificate>MIIFIj..mV7A==</ds:X509Certificate> </ds:X509Data> <ds:X509Data> <ds:X509Certificate>MIIFDj..5uLcw=</ds:X509Certificate> </ds:X509Data> <ds:X509Data> <ds:X509Certificate>MIIE/z..3IDhA=</ds:X509Certificate> </ds:X509Data> <ds:X509Data> <ds:X509Certificate>MIIEkT..5/WrQ8</ds:X509Certificate> </ds:X509Data> </ds:KeyInfo> </ds:Signature> </saml2:Assertion> </saml2p:Response>
解决方法
版权声明:本文内容由互联网用户自发贡献,该文观点与技术仅代表作者本人。本站仅提供信息存储空间服务,不拥有所有权,不承担相关法律责任。如发现本站有涉嫌侵权/违法违规的内容, 请发送邮件至 dio@foxmail.com 举报,一经查实,本站将立刻删除。