Exclusive Canonicalization transform "http://www.w3.org/TR/2001/REC-xml-c14n-20010315#WithComments" algorithm is not supported by ADFS 4.0

Hi,

I setup a SP and using servlet to generate metedata xml by referencing java-saml/samples/java-saml-tookit-jspsample/src/main/webapp/metadata.jsp. I saved the metadata as xml file and import to ADFS 4.0 by adding relaying party trust function, then the error is as below: It says “Exclusive Canonicalization transform “http://www.w3.org/TR/2001/REC-xml-c14n-20010315#WithComments” algorithm is not supported”.

I checked the http://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf at line 2941:

Signatures in SAML messages SHOULD NOT contain transforms other than the enveloped signature transform (with the identifier http://www.w3.org/2000/09/xmldsig#enveloped-signature) or the exclusive canonicalization transforms (with the identifier http://www.w3.org/2001/10/xml-exc-c14n# or http://www.w3.org/2001/10/xml-exc-c14n#WithComments).

If I am right, “http://www.w3.org/TR/2001/REC-xml-c14n-20010315#WithComments” is added in com.onelogin.saml2.util.Util line 1087: transforms.addTransform(c14nMethod);

Is it a correct code? It seems ADFS 4.0 doesn’t accept it. Or I need to config ADFS to accept it?

Please let me know if any comments, thank you very much.

[pitbulk]

It seems I added the wrong c14 method, please replace at the Line 1109 of Util.java

String c14nMethod = Constants.C14N_WC;

by

String c14nMethod = Constants.C14NEXC_WC;

And let me know if that fixes your issue.

[dave-handy]

I believe we found the issue with the signature verification, in that the cert my team is using is self signed, and it seems that ADFS performs a revocation and trust chain verification on the signer cert by default, unlike other IDPs we’ve worked with. I am still using the patched version of java-saml with your suggested change to the c14nMethod value, which does appear to be necessary to even get this far.

TLDR; I think the change is working, but you probably want some additional verification 😉 I pushed up a PR with the change