Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

Some XML parsers contain options that will attempt to "help" you. For example, by performing some sort of string normalization on attribute/element content or namespaces. This will almost always break signatures. Enabling "in-line" schema validation (i.e., performing schema validation while parsing) can also lead to problems if the schema populates the resulting DOM with schema-defaulted values for attributes.

In the case of opensaml, which usually relies on Xerces for its XML parsing, be aware of the parser feature http://apache.org/xml/features/validation/schema/normalized-value.

4. Validate the signature with known-good tools

...