title: SAML-xmlsec1 verification
body: <p>I signed my saml response xml with xmlsec command:</p>
  
  <pre><code>xmlsec1 --sign --privkey-pem keys/privkey.pem,keys/cert.pem --id-attr:ID "urn:oasis:names:tc:SAML:2.0:protocol:Assertion" --output signed_res.xml saml_response.xml
  </code></pre>
  
  <p>Here is my XML:</p>
  
  <pre><code>&lt;?xml version="1.0"?&gt;
  &lt;samlp:Response xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:ds="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" ID="GOSAMLRESPONSE1484161444050744957968075" Version="2.0" IssueInstant="2017-01-10T19:04:04Z" Destination="https://mail.google.com/a/demo.mediaagility.com" InResponseTo="aejlhgifgamagkaobldafdnifhllkclmdkdmgmjf"&gt;
      &lt;saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"&gt;https://127.0.0.1/login&lt;/saml:Issuer&gt;
      &lt;samlp:Status&gt;
              &lt;samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/&gt;
      &lt;/samlp:Status&gt;
      &lt;ds:Signature xmlns="http://www.w3.org/2000/09/xmldsig#"&gt;
          &lt;ds:SignedInfo&gt;
              &lt;ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/&gt;
              &lt;ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/&gt;
              &lt;ds:Reference ID="#GOSAMLASSERTION1484161444050744957968075"&gt;
                  &lt;ds:Transforms&gt;
                      &lt;ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/&gt;
                      &lt;ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/&gt;
                  &lt;/ds:Transforms&gt;
                  &lt;ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/&gt;
                  &lt;ds:DigestValue&gt;7qAlp8q4w58e7v5hQpU/xkbbaSM=&lt;/ds:DigestValue&gt;
              &lt;/ds:Reference&gt;
          &lt;/ds:SignedInfo&gt;
          &lt;ds:SignatureValue&gt;Nx8Kpiglxw+ZwXp80nvM6eH09DyHWNHsFMtIgXXBLKVSiOOc9tlvULKg5+09vRxU
  O453dmRZ6OXEnpxkBD6WPC3YzJDoNFLWK+VytshgXLlk+kXMBPP+/fw0imkPP7cO
  y8YAjdt6q9+QtSCFztYcIDya3Vrz3i9X0ggck0WcJX4=&lt;/ds:SignatureValue&gt;
          &lt;ds:KeyInfo&gt;
          &lt;ds:X509Data&gt;
  &lt;ds:X509Certificate&gt;MIICtjCCAh+gAwIBAgIJAJTeBUN2i9ZNMA0GCSqGSIb3DQEBBQUAME4xCzAJBgNV
  BAYTAkhSMQ8wDQYDVQQIEwZaYWdyZWIxITAfBgNVBAoTGE5la2Egb3JnYW5pemFj
  aWphIGQuby5vLjELMAkGA1UEAxMCQ0EwHhcNMTIxMjI4MTYwODA1WhcNMTQxMjI4
  MTYwODA1WjBvMQswCQYDVQQGEwJIUjEPMA0GA1UECBMGWmFncmViMQ8wDQYDVQQH
  EwZaYWdyZWIxITAfBgNVBAoTGE5la2Egb3JnYW5pemFjaWphIGQuby5vLjEbMBkG
  A1UEAxMSUHJvZ3JhbWVyc2thIGZpcm1hMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCB
  iQKBgQCgWApHV5cma0GY/v/vmwgciDQBgITcitx2rG0F+ghXtGiEJeK75VY7jQwE
  UFCbgV+AaOY2NQChK2FKec7Hss/5y+jbWfX2yVwX6TYcCwnOGXenz+cgx2Fwqpu3
  ncL6dYJMfdbKvojBaJQLJTaNjRJsZACButDsDtXDSH9QaRy+hQIDAQABo3sweTAJ
  BgNVHRMEAjAAMCwGCWCGSAGG+EIBDQQfFh1PcGVuU1NMIEdlbmVyYXRlZCBDZXJ0
  aWZpY2F0ZTAdBgNVHQ4EFgQUSo9ThP/MOg8QIRWxoPo8qKR8O2wwHwYDVR0jBBgw
  FoAUAelckr4bx8MwZ7y+VlHE46Mbo+cwDQYJKoZIhvcNAQEFBQADgYEAy19Z7Z5/
  /MlWkogu41s0RxL9ffG60QQ0Y8hhDTmgHNx1itj0wT8pB7M4KVMbZ4hjjSFsfRq4
  Vj7jm6LwU0WtZ3HGl8TygTh8AAJvbLROnTjLL5MqI9d9pKvIIfZ2Qs3xmJ7JEv4H
  UHeBXxQq/GmfBv3l+V5ObQ+EHKnyDodLHCk=&lt;/ds:X509Certificate&gt;
  &lt;/ds:X509Data&gt;
          &lt;/ds:KeyInfo&gt;
      &lt;/ds:Signature&gt;
      &lt;saml:Assertion xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xs="http://www.w3.org/2001/XMLSchema" ID="GOSAMLASSERTION1484161444050744957968075" Version="2.0" IssueInstant="2017-01-10T19:04:04Z"&gt;
          &lt;saml:Issuer&gt;https://127.0.0.1/login&lt;/saml:Issuer&gt;
          &lt;saml:Subject&gt;
              &lt;saml:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:email"&gt;admin@demo.mediaagility.com&lt;/saml:NameID&gt;
              &lt;saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"&gt;
                  &lt;saml:SubjectConfirmationData NotOnOrAfter="2017-01-12T19:04:04Z" Recipient="https://mail.google.com/a/demo.mediaagility.com" InResponseTo="aejlhgifgamagkaobldafdnifhllkclmdkdmgmjf"/&gt;
              &lt;/saml:SubjectConfirmation&gt;
          &lt;/saml:Subject&gt;
          &lt;saml:Conditions NotBefore="2017-01-10T19:04:04Z" NotOnOrAfter="2017-01-12T19:04:04Z"&gt;
              &lt;saml:AudienceRestriction&gt;
                  &lt;saml:Audience&gt;https://mail.google.com/a/demo.mediaagility.com&lt;/saml:Audience&gt;
              &lt;/saml:AudienceRestriction&gt;
          &lt;/saml:Conditions&gt;
          &lt;saml:AuthnStatement AuthnInstant="2017-01-10T19:04:04Z" SessionNotOnOrAfter="2017-01-12T19:04:04Z"&gt;
              &lt;saml:AuthnContext&gt;
                  &lt;saml:AuthnContextClassRef&gt;urn:oasis:names:tc:SAML:2.0:ac:classes:Password&lt;/saml:AuthnContextClassRef&gt;
              &lt;/saml:AuthnContext&gt;
          &lt;/saml:AuthnStatement&gt;
      &lt;/saml:Assertion&gt;
  &lt;/samlp:Response&gt;
  </code></pre>
  
  <p>but when verifying the same signed saml xml using this command:</p>
  
  <pre><code>xmlsec1 --verify --X509-skip-strict-checks --id-attr:ID "urn:oasis:names:tc:SAML:2.0:protocol:Assertion" --trusted-pem keys/cacert.pem saml_response.xml
  </code></pre>
  
  <p>I am getting this:</p>
  
  <pre><code>func=xmlSecBase64Decode:file=base64.c:line=740:obj=unknown:subj=buf != NULL:error=100:assertion: 
  func=xmlSecBufferBase64NodeContentRead:file=buffer.c:line=563:obj=unknown:subj=xmlSecBase64Decode:error=1:xmlsec library function failed: 
  func=xmlSecTransformVerifyNodeContent:file=transforms.c:line=1776:obj=sha1:subj=xmlSecBufferBase64NodeContentRead:error=1:xmlsec library function failed: 
  func=xmlSecDSigReferenceCtxProcessNode:file=xmldsig.c:line=1602:obj=unknown:subj=xmlSecTransformVerifyNodeContent:error=1:xmlsec library function failed: 
  func=xmlSecDSigCtxProcessSignedInfoNode:file=xmldsig.c:line=804:obj=unknown:subj=xmlSecDSigReferenceCtxProcessNode:error=1:xmlsec library function failed:node=Reference
  func=xmlSecDSigCtxProcessSignatureNode:file=xmldsig.c:line=547:obj=unknown:subj=xmlSecDSigCtxProcessSignedInfoNode:error=1:xmlsec library function failed: 
  func=xmlSecDSigCtxVerify:file=xmldsig.c:line=366:obj=unknown:subj=xmlSecDSigCtxSigantureProcessNode:error=1:xmlsec library function failed: 
  Error: signature failed 
  ERROR
  SignedInfo References (ok/all): 0/1
  Manifests References (ok/all): 0/0
  Error: failed to verify file "saml_response.xml"
  </code></pre>
  
  <p>I want to use SAML with Google as Google as SP.</p>