redirect binding computes incorrect signatures for SAML responses ----------------------------------------------------------------- Key: JBID-132 URL: https://jira.jboss.org/jira/browse/JBID-132 Project: JBoss Identity Issue Type: Bug Components: Identity-Federation Affects Versions: IDFED-1.0.0.alpha3 Reporter: Marcel Kolsteren Assignee: Anil Saldhana Fix For: IDFED-1.0.0.alpha4 Attachments: JBID-132.txt When using the HTTP/Redirect binding with signature support, the signatures for SAMLResponse messages are incorrect. This is caused by the computeSignature method in the RedirectBindingSignatureUtil. This method is called for requests as well as for responses, but when it constructs the string that needs to be signed, it always uses "SAMLRequest": sb.append("SAMLRequest=").append(urlEncodedRequest);