Take the 2-minute tour ×

I am interfacing with an IDP and have a basic AuthNRequest created as follows:


IDP wants me send the request as signed. My questions are:

  1. How do I set digest value?
  2. How do I set Signature value?
  3. For x509 certificate, I set the public key of my app. Correct?
  4. What is the data that is used to compute any of the values? Is it my original auth request without Signature element?
share|improve this question
I have edited your title. Please see, "Should questions include “tags” in their titles?", where the consensus is "no, they should not". –  John Saunders Mar 6 '13 at 19:09
@user1922049 : If u get the answer can u post that by editing ur question? –  mavis Mar 18 at 11:45

4 Answers 4

If your into constructing your own requests without any bigger frameworks around I can recommend OpenSAML. Its a library to help with the construction of SAML messages.

Here is an example I wrote on signing SAML messages

And one on how to dispatch AuthnRequests.

share|improve this answer

Just to note that a lot of this is covered in the documentation:

SAML metadata.

To have the request signed you need to add something like this (normally found in the sp.xml):

<SPSSODescriptor AuthnRequestsSigned="true" WantAssertionsSigned="false" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">

The signing key would look something like:

<KeyDescriptor use="signing">
                    <ds:X509Certificate>      MIIDWTC...CAkGgAwIBAgIEe+a+/uaSZCp5g2z+hRWRV+DyfQc9nO

where the MII... is the public key.

As per @Stefan, it's much easier to use a library.

share|improve this answer

SAML Authentication Request is an XML document. You can sign SAML Authentication Request just like signing any other XML document. There are, however, some restrictions:

  1. The signature must be enveloped signature.
  2. Before it is digested, the SAML Authentication Request must not be transformed by method other than enveloped signature transform and exclusive canonicalization transform.
  3. The Signature element must contain only one Reference element.
  4. The URI of the only Reference element must contain the value of the ID attribute of the signed SAML Authentication Request.
  5. Before it is signed, the SignedInfo element must be canonicalize using exclusive canonicalization method.

You can read more detail the SAML Assertions and Protocols Specification (http://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf) in Section 5.

share|improve this answer

Well things concerning security are never easy... you sholud definetly check documentation Linked by @nzpcmad, as well as SAML2 profiles (look for WB SSO - Web Browser Single Sign On).

For Java OpenSaml is indeed one of easiest solutions.

share|improve this answer

Your Answer


