[security-dev] SAML SSO with signatures error

[Eric Wittmann]

Hi guys.

I'm using the EAP IDP Valve with the SPFilter servlet filter running on 
EAP 6.3.0 to implement web SSO.  It works fine without signatures, but 
now I'm trying to enable signatures on the IDP (meaning I want the IDP 
to sign the saml response and I want the SPFilter to verify the sig). 
I'm using picketlink 2.5.3.SP1 packaged into the SP WAR.  I'm using 
whatever picketlink version comes with EAP 6.3 (2.5.3.SP5 I think).

I currently have two problems.  The first is that the SPFilter does this 
in the verifySignature() method:

         URL issuerURL;
         try {
             issuerURL = new URL(issuerID);
         } catch (MalformedURLException e1) {
             throw new IssuerNotTrustedException(e1);
         }

This code fails for me because the issuerID in the saml response is 
"/overlord-idp/".  I haven't dug into this yet, but I imagine I need to 
tweak something on the IDP to get it to put in a full issuer into the 
saml response.

I can get past that with the debugger (by modifying the issuerID value) 
but when I do I hit the following stack trace:

https://gist.github.com/EricWittmann/f05b65689367ba321fc8

The Signature in the saml response seems ok when I eyeball it.  That 
stack trace is pretty opaque to me - does anyone have any insight into it?

-Eric