Allow the digital signature namespace to be at the top level of the SAML response. #123
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
the xml dsig namespace can be specified at the root of the SAML response instead of on each Signature element. The canonincalized xml for the signature element requires that the namespace declaration be present on the siganture element.
BACK-2900 Accept saml response with xml sig namespace at the root level
No signature xml method
Fix npm security problems
KDEV-1276: Bump xml-crypto to latest version
This was referenced Feb 3, 2021
KDEV-1764: npm-security updates
KDEV-2394: Fixed npm security
… update 'xml-crypto'
KDEV-2709: Fix npm security
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
We started receiving SAML responses from an IdP (Oracle Access Manager) that had the dsig namespace declared at the top of the response xml instead of on each signature element. The signature verifcation failed due to the xml.toString() before the sig.computeSignature() call. Passing the xmldom object directly instead of the result of the toString call fixed the problem. The toString was not rendering the namespace value in the xml.
Similar issue was solved here:
node-saml/xml-crypto#84