samlsign

samlsign is a test program developed to exercise a variety of options related to creating and verifying signatures using the OpenSAML and XMLTooling code and plugins. It isn't formally a utility designed for end users of applications that are built with the library, nor is it meant as a generic signature tool, but it's powerful enough to be used to sign and verify SAML-oriented XML content.

It's also useful in some cases to debug SAML interactions, because it has the ability to instantiate a MetadataProvider and apply it via a TrustEngine plugin to verify a signature, emulating the process an actual OpenSAML application should be using.

See the following sections for information on the various parameters supported.

To use the program to sign or verify something, you must supply XML that can be parsed into an XMLObject that is a subclass of the OpenSAML SignableObject class. This includes all SAML objects that contain signatures. You can also supply XML that contains such an object by also supplying an "-id" parameter to locate the SAML object in the document.

Signing

To use the program for signing, you must pass a "-s" parameter.

At the moment, only RSA signing with the default SHA-1 digest is supported.

Input and Output

If neither -f or -u (below) is specified, then stdin is used for input.

When signing succeeds, the signed output is written to stdout

Supplying a Signing Key

Either -k or -R (below) must be specified.

Parameters for Signing

Verifying

If the "-s" parameter is omitted, the program assumes a verify operation.

In theory, any signature that can be processed by the libraries, and that you supply the right verification material for should be usable, but only RSA signatures have been tested. Some algorithms may be unsupported by your version of OpenSSL as well.

Input and Output

If neither -f or -u (below) is specified, then stdin is used for input.

The result of the verification will be logged at the INFO level via whatever logging configuration is supplied via the XMLTOOLING_LOG_CONFIG environment variable. WARN is the default level, so success will produce no output, and a 0 return code. Failure results in log messages and a negative return code.

Supplying a Verification Key

One of -c, -R or -T (below) is required. 

Most uses of the -T option to utilize a TrustEngine plugin will require supplying SAML metadata via the -M option for the entity that signed the XML. The metadata will be used to establish whether or not the signing key is trusted. 

When using the -M option extra parameterization (below) are used to identify the issuer of the XML to find in the metadata, and the various qualifiers used to identify the role in which the entity is acting. Trust information in metadata is specific to a role. 

Parameters for Signing