1

I have an application that uses SAML authentication, acts as an SP, and therefore parses SAMLResponses. I received notification that an IdP that communicates with my application will now start signing their SAMLResponses with http://www.w3.org/2001/10/xml-exc-c14n#WithComments instead of what they used to do, which was http://www.w3.org/2001/10/xml-exc-c14n. This new method means comments now matter when calculating the validity of the SAML signature.

Here's my question - when using the #WithComments canonicalization listed above, are these NameIDs equivalent? Or will they produce different SAML signatures?

<NameID> [email protected] </NameID>
<NameID> test <[email protected]> </NameID>
<NameID> test <!--@--> user.com </NameID>
<NameID> [email protected] <!----> </NameID>
Improve this question

1 Answer 1

Reset to default
5

This presumably is in response to https://www.kb.cert.org/vuls/id/475445.

The XML signatures will be different as the XML comments are part of the canonicalized XML that's signed.

Of course, the NameID value is [email protected] for the 1st and 4th examples, test user.com for the 2nd example and and test for the 3rd example.

The issue doesn't lie with the canonicalization method but rather with some SAML libraries which used the first text node as the NameID value rather than the concatenation of all the text nodes. For example, [email protected] could be changed to test<!--comment-->@user.com without affecting the signature and some SAML libraries would return test as the NameID.

Using http://www.w3.org/2001/10/xml-exc-c14n#WithComments would circumvent this issue but it would be still worthwhile checking whether your SAML library correctly handles embedded comments.

Improve this answer
3
  • My XML parsing library ignores comment nodes and concatenates all node text by default, so I won't be affected by the vulnerability. My application uses a home-rolled SAML implementation, and I'm just worried that any SAML responses from this IdP that have comments (for some reason) will fail authentication. In order to be compliant with the #WithComments method, my XML parsing library would have to return test<!--comment-->@user.com and not [email protected], correct? Because currently <NameID>test<!--comment-->@user.com</NameID> would result only in [email protected].
    – kibowki
    Commented Mar 2, 2018 at 15:39
  • Perhaps another way to phrase my question - could you expand on "correctly handling embedded comments"? What is the correct way to do that?
    – kibowki
    Commented Mar 2, 2018 at 16:29
  • The WithComments canonicalization will leave the comments in place for XML signature verificatio but this shouldn't be related to what you return to the calling application as the NameID. I don't think you what the comment to be part of the NameID used by your application. So the correct handling of comments means respecting the WithComments canonicalization as part of signaure verification but stripping the comment when returning the NameID to the calling application.
    – ComponentSpace
    Commented Mar 2, 2018 at 23:30

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .