ausaccessfed/federationregistrymaster — Issue #147: insufficient certificate checking
Author: ausaccessfed
Created: 2012-02-08 04:11:22+00:00
State: open

I've hit a case where a user did sloppy pasting of certificates in the
SP registration - and it got through the checking process and later
broke the metadata generation process.

After a bit of digging, I found that the issue was *not including* the
final hyphen in the final "-----END CERTIFICATE-----" line.

This way, most tools could still successfully parse the certificate, but
in the metadata generation process, this incomplete line was not
stripped off, producing this metada snippet to be generated for the SP:
(Note there are only 4 hyphens at the end of the line)

>
>
>
>
>
>
>
>
>
> MIIDMDCCAhigAwIBAgIJAKdIUmJFHLVrMA0GCSqGSIb3DQEBBQUAMCAxHjAcBgNV
> BAMTFWNvbm5lY3QuY2F1ZGl0LmVkdS5hdTAeFw0xMTA5MjIxNTQzMjJaFw0yMTA5
> MTkxNTQzMjJaMCAxHjAcBgNVBAMTFWNvbm5lY3QuY2F1ZGl0LmVkdS5hdTCCASIw
> DQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALU9QCncxWr5yKllWAHUgKeBx8gw
> kme5zCdcOc7+wh4BLaDt8IrFRHAYFh0EW3cOE6o6Vi7qkOCwQSX9uGI9m2LY4rPg
> sdFtyv29k2jkHtNwVsYrX6UU1ixzWAPwVWp1ihecV4cn4duoSpu7xHAofOHWyEhf
> O0X/GIk/sR1GoTRSP2R377d53gxZWJ3GykuRUZPUlY0ZDupySJnKGxgtEzdrieIU
> 0KIu8/BeUA8CDGjrESpkMGpCk1EQcB1NFdrjVFHhn45BAI4+16UmFbvCBAM7j0PO
> SkiyxAQXsDsTGmNyKpXKjJbnNb8GQ/JQXVedun9JFTr75RQuo4jJ8LRVUi8CAwEA
> AaNtMGswSgYDVR0RBEMwQYIVY29ubmVjdC5jYXVkaXQuZWR1LmF1hihodHRwczov
> L2Nvbm5lY3QuY2F1ZGl0LmVkdS5hdS9zaGliYm9sZXRoMB0GA1UdDgQWBBT8JJ5p
> yRil3RGycXFxQofAl2DkWTANBgkqhkiG9w0BAQUFAAOCAQEAAHTtFljGSSU7xpIP
> iSEQdYZ+F7erD3CD91eLcGB4TzKsG/bSLfs9ETnfD0V/UUuzWIuPUivPCdimsCsj
> s+XabtPY7YNnu0ssz2zjyuFLCyicZW6Hr+3utW4QFbsdYtCxC+SLmELIonBlpHen
> nGFP7EzBk76xgEs5E8gVXMOyqkaBALHktb95PzmN5g3nYBVeZFpbuwN1YcBw2rDX
> h6Qs+b+eu9cdDXl5sfiI5cCJuwBtNzFKIIU8T4m8xFcZkuwozTCoXxlj+ufgyN4Z
> nFDBFcQlKQHVnv2QNvYIgpc4/9DZmB4Jj5Jwu9sQz5pUtA4Pge1qAZ1aizl34i3L
> SEBurA==
> -----END CERTIFICATE----
>
>
>
>
>
>
>
> MIIDMDCCAhigAwIBAgIJAKdIUmJFHLVrMA0GCSqGSIb3DQEBBQUAMCAxHjAcBgNV
> BAMTFWNvbm5lY3QuY2F1ZGl0LmVkdS5hdTAeFw0xMTA5MjIxNTQzMjJaFw0yMTA5
> MTkxNTQzMjJaMCAxHjAcBgNVBAMTFWNvbm5lY3QuY2F1ZGl0LmVkdS5hdTCCASIw
> DQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALU9QCncxWr5yKllWAHUgKeBx8gw
> kme5zCdcOc7+wh4BLaDt8IrFRHAYFh0EW3cOE6o6Vi7qkOCwQSX9uGI9m2LY4rPg
> sdFtyv29k2jkHtNwVsYrX6UU1ixzWAPwVWp1ihecV4cn4duoSpu7xHAofOHWyEhf
> O0X/GIk/sR1GoTRSP2R377d53gxZWJ3GykuRUZPUlY0ZDupySJnKGxgtEzdrieIU
> 0KIu8/BeUA8CDGjrESpkMGpCk1EQcB1NFdrjVFHhn45BAI4+16UmFbvCBAM7j0PO
> SkiyxAQXsDsTGmNyKpXKjJbnNb8GQ/JQXVedun9JFTr75RQuo4jJ8LRVUi8CAwEA
> AaNtMGswSgYDVR0RBEMwQYIVY29ubmVjdC5jYXVkaXQuZWR1LmF1hihodHRwczov
> L2Nvbm5lY3QuY2F1ZGl0LmVkdS5hdS9zaGliYm9sZXRoMB0GA1UdDgQWBBT8JJ5p
> yRil3RGycXFxQofAl2DkWTANBgkqhkiG9w0BAQUFAAOCAQEAAHTtFljGSSU7xpIP
> iSEQdYZ+F7erD3CD91eLcGB4TzKsG/bSLfs9ETnfD0V/UUuzWIuPUivPCdimsCsj
> s+XabtPY7YNnu0ssz2zjyuFLCyicZW6Hr+3utW4QFbsdYtCxC+SLmELIonBlpHen
> nGFP7EzBk76xgEs5E8gVXMOyqkaBALHktb95PzmN5g3nYBVeZFpbuwN1YcBw2rDX
> h6Qs+b+eu9cdDXl5sfiI5cCJuwBtNzFKIIU8T4m8xFcZkuwozTCoXxlj+ufgyN4Z
> nFDBFcQlKQHVnv2QNvYIgpc4/9DZmB4Jj5Jwu9sQz5pUtA4Pge1qAZ1aizl34i3L
> SEBurA==
> -----END CERTIFICATE----
>
>
>
>
> CAUDIT
> Richard
> Northam
> richard.northam@caudit.edu.au
>
>
>
>
>
>
>
>
>
> urn:oasis:names:tc:SAML:2.0:nameid-format:transient
>
>
>
> CAUDIT Connect
>
>
>
>
> Council of Australian University Directors of Information Technology
> CAUDIT
> http://www.caudit.edu.au
>
>

which in turn caused the metadata signing scripts to break with:

> INFO XmlSecTool - Reading XML document from file '/opt/mdsigner/Tuakiri/work/tuakiri-metadata.xml'
> INFO XmlSecTool - XML document parsed and is well-formed.
> ERROR XmlSecTool - Invalid XML schema files, unable to validate XML
> org.xml.sax.SAXParseException: cvc-datatype-valid.1.2.1: '
> MIIDMDCCAhigAwIBAgIJAKdIUmJFHLVrMA0GCSqGSIb3DQEBBQUAMCAxHjAcBgNV
> BAMTFWNvbm5lY3QuY2F1ZGl0LmVkdS5hdTAeFw0xMTA5MjIxNTQzMjJaFw0yMTA5
> MTkxNTQzMjJaMCAxHjAcBgNVBAMTFWNvbm5lY3QuY2F1ZGl0LmVkdS5hdTCCASIw
> DQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALU9QCncxWr5yKllWAHUgKeBx8gw
> kme5zCdcOc7+wh4BLaDt8IrFRHAYFh0EW3cOE6o6Vi7qkOCwQSX9uGI9m2LY4rPg
> sdFtyv29k2jkHtNwVsYrX6UU1ixzWAPwVWp1ihecV4cn4duoSpu7xHAofOHWyEhf
> O0X/GIk/sR1GoTRSP2R377d53gxZWJ3GykuRUZPUlY0ZDupySJnKGxgtEzdrieIU
> 0KIu8/BeUA8CDGjrESpkMGpCk1EQcB1NFdrjVFHhn45BAI4+16UmFbvCBAM7j0PO
> SkiyxAQXsDsTGmNyKpXKjJbnNb8GQ/JQXVedun9JFTr75RQuo4jJ8LRVUi8CAwEA
> AaNtMGswSgYDVR0RBEMwQYIVY29ubmVjdC5jYXVkaXQuZWR1LmF1hihodHRwczov
> L2Nvbm5lY3QuY2F1ZGl0LmVkdS5hdS9zaGliYm9sZXRoMB0GA1UdDgQWBBT8JJ5p
> yRil3RGycXFxQofAl2DkWTANBgkqhkiG9w0BAQUFAAOCAQEAAHTtFljGSSU7xpIP
> iSEQdYZ+F7erD3CD91eLcGB4TzKsG/bSLfs9ETnfD0V/UUuzWIuPUivPCdimsCsj
> s+XabtPY7YNnu0ssz2zjyuFLCyicZW6Hr+3utW4QFbsdYtCxC+SLmELIonBlpHen
> nGFP7EzBk76xgEs5E8gVXMOyqkaBALHktb95PzmN5g3nYBVeZFpbuwN1YcBw2rDX
> h6Qs+b+eu9cdDXl5sfiI5cCJuwBtNzFKIIU8T4m8xFcZkuwozTCoXxlj+ufgyN4Z
> nFDBFcQlKQHVnv2QNvYIgpc4/9DZmB4Jj5Jwu9sQz5pUtA4Pge1qAZ1aizl34i3L
> SEBurA==
> -----END CERTIFICATE----' is not a valid value for 'base64Binary'.
> at org.apache.xerces.util.ErrorHandlerWrapper.createSAXParseException(Unknown Source) ~[na:na]
> at org.apache.xerces.util.ErrorHandlerWrapper.error(Unknown Source) ~[na:na]
> at org.apache.xerces.impl.XMLErrorReporter.reportError(Unknown Source) ~[na:na]
> at org.apache.xerces.impl.XMLErrorReporter.reportError(Unknown Source) ~[na:na]
> at org.apache.xerces.impl.XMLErrorReporter.reportError(Unknown Source) ~[na:na]
> at org.apache.xerces.impl.xs.XMLSchemaValidator$XSIErrorReporter.reportError(Unknown Source) ~[na:na]
> at org.apache.xerces.impl.xs.XMLSchemaValidator.reportSchemaError(Unknown Source) ~[na:na]
> at org.apache.xerces.impl.xs.XMLSchemaValidator.elementLocallyValidType(Unknown Source) ~[na:na]
> at org.apache.xerces.impl.xs.XMLSchemaValidator.processElementContent(Unknown Source) ~[na:na]
> at org.apache.xerces.impl.xs.XMLSchemaValidator.handleEndElement(Unknown Source) ~[na:na]
> at org.apache.xerces.impl.xs.XMLSchemaValidator.endElement(Unknown Source) ~[na:na]
> at org.apache.xerces.jaxp.validation.DOMValidatorHelper.finishNode(Unknown Source) ~[na:na]
> at org.apache.xerces.jaxp.validation.DOMValidatorHelper.validate(Unknown Source) ~[na:na]
> at org.apache.xerces.jaxp.validation.DOMValidatorHelper.validate(Unknown Source) ~[na:na]
> at org.apache.xerces.jaxp.validation.ValidatorImpl.validate(Unknown Source) ~[na:na]
> at javax.xml.validation.Validator.validate(Unknown Source) ~[na:1.4.01]
> at edu.internet2.middleware.security.XmlSecTool.schemaValidate(XmlSecTool.java:349) [xmlsectool-1.1.5.jar:na]
> at edu.internet2.middleware.security.XmlSecTool.main(XmlSecTool.java:148) [xmlsectool-1.1.5.jar:na]
>