Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Custom KeyInfo, avoid adding empty/unneeded namespaces #170

Closed
roelandmoors opened this issue Feb 2, 2019 · 3 comments · Fixed by #171
Closed

Custom KeyInfo, avoid adding empty/unneeded namespaces #170

roelandmoors opened this issue Feb 2, 2019 · 3 comments · Fixed by #171

Comments

@roelandmoors
Copy link

I'm trying to create a custom KeyInfo. This mostly works with something like this:

function AssertionKeyInfo(assertionId) {
  this.getKeyInfo = function(key, prefix) {
    return `<wsse:SecurityTokenReference wsse11:TokenType="http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1" wsu:Id="STR-${uuidv4()}" 
          xmlns:wsse11="http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd">
          <wsse:KeyIdentifier ValueType="http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID">${assertionId}</wsse:KeyIdentifier>
      </wsse:SecurityTokenReference>`;
  };
}

This is the result:

<ds:KeyInfo>
	<wsse:SecurityTokenReference wsse11:TokenType="http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1" 
		xmlns:wsu="" wsu:Id="STR-ce7f89b3-d5c0-459c-b2e7-3fd656ff7cb9" 
		xmlns:wsse11="http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd" 
		xmlns:wsse="">
		<wsse:KeyIdentifier ValueType="http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID">_81d5fba5c807be9e9cf60c58566349b1</wsse:KeyIdentifier>
	</wsse:SecurityTokenReference>
</ds:KeyInfo>

The problem is that the prefix wsu and wsse is added here.
This is not needed because the namespaces are already defined outside the signature.

Is there a way to prevent adding these namespaces?

I guess this happens because the signature is parsed as a separate document?
var signatureDoc = new Dom().parseFromString(this.signatureXml)

@roelandmoors
Copy link
Author

I could create a PR, but not sure about the best method. Maybe getKeyInfo shoud be done inside createSignature so that I can use dummySignatureWrapper with some extra namespaces defined in options?

@LoneRifle
Copy link
Collaborator

LoneRifle commented Feb 7, 2019

There is a bigger reason to this - namespace propagation in xmldom does not appear to work correctly, see examples of this in jindw/xmldom#247. I would suggest following up there in addition to the PR you have submitted, but it seems that the package is no longer actively maintained, and I already have too much on my hands tending to this package.

@markstos
Copy link

Are there sections of the XML signature spec that address the correct behavior here?
https://www.w3.org/TR/xmldsig-core2/

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

3 participants