I have an application that uses SAML authentication, acts as an SP, and therefore parses SAMLResponses. I received notification that an IdP that communicates with my application will now start signing their SAMLResponses with http://www.w3.org/2001/10/xml-exc-c14n#WithComments instead of what they used to do, which was http://www.w3.org/2001/10/xml-exc-c14n. This new method means comments now matter when calculating the validity of the SAML signature.

Here's my question - when using the #WithComments canonicalization listed above, are these NameIDs equivalent? Or will they produce different SAML signatures?

<NameID> test@user.com </NameID>
<NameID> test <!--@user.com--> </NameID>
<NameID> test <!--@--> user.com </NameID>
<NameID> test@user.com <!----> </NameID>

This presumably is in response to https://www.kb.cert.org/vuls/id/475445.

The XML signatures will be different as the XML comments are part of the canonicalized XML that's signed.

Of course, the NameID value is test@user.com for the 1st and 4th examples, test user.com for the 2nd example and and test for the 3rd example.

The issue doesn't lie with the canonicalization method but rather with some SAML libraries which used the first text node as the NameID value rather than the concatenation of all the text nodes. For example, test@user.com could be changed to test<!--comment-->@user.com without affecting the signature and some SAML libraries would return test as the NameID.

Using http://www.w3.org/2001/10/xml-exc-c14n#WithComments would circumvent this issue but it would be still worthwhile checking whether your SAML library correctly handles embedded comments.

  • My XML parsing library ignores comment nodes and concatenates all node text by default, so I won't be affected by the vulnerability. My application uses a home-rolled SAML implementation, and I'm just worried that any SAML responses from this IdP that have comments (for some reason) will fail authentication. In order to be compliant with the #WithComments method, my XML parsing library would have to return test<!--comment-->@user.com and not test@user.com, correct? Because currently <NameID>test<!--comment-->@user.com</NameID> would result only in test@user.com. – twilco Mar 2 '18 at 15:39
  • Perhaps another way to phrase my question - could you expand on "correctly handling embedded comments"? What is the correct way to do that? – twilco Mar 2 '18 at 16:29
  • The WithComments canonicalization will leave the comments in place for XML signature verificatio but this shouldn't be related to what you return to the calling application as the NameID. I don't think you what the comment to be part of the NameID used by your application. So the correct handling of comments means respecting the WithComments canonicalization as part of signaure verification but stripping the comment when returning the NameID to the calling application. – ComponentSpace Mar 2 '18 at 23:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.