OSTwoUsrManCPPsamlsign

samlsign is a test program developed to exercise a variety of options related to creating and verifying signatures using the OpenSAML and XMLTooling code and plugins. It isn't formally a utility designed for end users of applications that are built with the library, nor is it meant as a generic signature tool, but it's powerful enough to be used to sign and verify SAML-oriented XML content.

It's also useful in some cases to debug SAML interactions, because it has the ability to instantiate a MetadataProvider and apply it via a TrustEngine plugin to verify a signature, emulating the process an actual OpenSAML application should be using.

See the following sections for information on the various parameters supported.

To use the program to sign or verify something, you must supply XML that can be parsed into an XMLObject that is a subclass of the OpenSAML SignableObject class. This includes all SAML objects that contain signatures. You can also supply XML that contains such an object by also supplying an "-id" parameter to locate the SAML object in the document.

Signing

To use the program for signing, you must pass a "-s" parameter.

At the moment, only RSA signing with the default SHA-1 digest is supported.

Input and Output

If neither parameter is used, then stdin is used for input.

When signing succeeds, the signed output is written to stdout.

Supplying a Signing Key

One of these parameters is required. In the latter case, you must create a small XML file containing a configuration snippet that instantiates a plugin. An example follows.

<CredentialResolver type="File" key="/path/to/key.pem"/>

Optional Parameters

Verifying

If the "-s" parameter is omitted, the program assumes a verify operation.

In theory, any signature that can be processed by the libraries, and that you supply the right verification material for should be usable, but only RSA signatures have been tested. Some algorithms may be unsupported by your version of OpenSSL as well.

Input and Output

If neither parameter is used, then stdin is used for input.

The result of the verification will be logged at the INFO level via whatever logging configuration is supplied via the XMLTOOLING_LOG_CONFIG environment variable. WARN is the default level, so success will produce no output, and a 0 return code. Failure results in log messages and a negative return code.

Supplying a Verification Key

One of the first three parameters is required. The last is usually required if "-T" is used, though not always.

In the latter cases, you must create a small XML file containing a configuration snippet that instantiates a plugin. Examples follow.

<CredentialResolver type="File" certificate="/path/to/cert.pem"/>

<TrustEngine type="ExplicitKey"/>

<MetadataProvider type="XML" file="/path/to/metadata.xml"/>

Supplying Metadata

Most uses of the "-T" option to utilize a TrustEngine plugin will require supplying SAML metadata via the "-M" option for the entity that signed the XML. The metadata will be used to establish whether or not the signing key is trusted.

When using this option, the following parameters are used to identify the issuer of the XML to find in the metadata, and the various qualifiers used to identify the role in which the entity is acting. Trust information in metadata is specific to a role.