I have an application that uses SAML authentication, acts as an SP, and therefore parses SAMLResponses. I received notification that an IdP that communicates with my application will now start signing their SAMLResponses with http://www.w3.org/2001/10/xml-exc-c14n#WithComments instead of what they used to do, which was http://www.w3.org/2001/10/xml-exc-c14n. This new method means comments now matter when calculating the validity of the SAML signature.
Here's my question - when using the #WithComments canonicalization listed above, are these
NameIDs equivalent? Or will they produce different SAML signatures?
<NameID> firstname.lastname@example.org </NameID> <NameID> test <!--@user.com--> </NameID> <NameID> test <!--@--> user.com </NameID> <NameID> email@example.com <!----> </NameID>