xmlsec1

A SAML assertion proves it came from the IdP with an XML digital signature (XML-DSIG) over the assertion. xmlsec1 --verify checks that signature against a key, and --pubkey-cert-pem says to trust the key in a given certificate — the IdP's published one, the SAML trust anchor. --sign makes a signature with a private key and embeds its certificate. Two flags matter in practice: --id-attr:ID tells xmlsec which element the signature's Reference (#_a1b2c3) points at, and in xmlsec1 1.3 --lax-key-search lets it use the embedded key without an exact key-name match. The verdict is one word, OK, and a non-zero exit when the signature does not hold.

xmlsec1 command usage

xmlsec1 --verify [--lax-key-search] --pubkey-cert-pem CERT --id-attr:ID NS:Element FILE
xmlsec1 --sign [--lax-key-search] --privkey-pem KEY,CERT --id-attr:ID NS:Element FILE

Options

--verify

check the document's XML signature

--sign

make an XML signature over the document

--pubkey-cert-pem CERT

trust the public key in this certificate (the IdP's)

--privkey-pem KEY,CERT

sign with this private key and embed this certificate

--id-attr:ID NS:Element

name the ID attribute the signature's Reference points at

--lax-key-search

use the embedded key without an exact key-name match (needed in xmlsec1 1.3)

xmlsec1 examples

xmlsec1 --verify --lax-key-search --pubkey-cert-pem /root/idp-saml.crt --id-attr:ID urn:oasis:names:tc:SAML:2.0:assertion:Assertion /root/saml-response.xml

Verifies the assertion's signature against the IdP's certificate.

xmlsec1 --sign --lax-key-search --privkey-pem /etc/idp-saml/idp-saml.key,/etc/idp-saml/idp-saml.crt --id-attr:ID urn:oasis:names:tc:SAML:2.0:assertion:Assertion assertion.xml

Signs the assertion with the IdP's private key and embedded certificate.

Reading the output

$ xmlsec1 --verify --lax-key-search --pubkey-cert-pem /root/idp-saml.crt --id-attr:ID urn:oasis:names:tc:SAML:2.0:assertion:Assertion /root/saml-response.xml
OK
SignedInfo References (ok/all): 1/1
Manifests References (ok/all): 0/0

• OK is the whole verdict: the IdP signed this assertion and no byte changed since.
• A changed byte, or a wrong certificate, prints FAIL and exits non-zero.

Pitfalls

• In xmlsec1 1.3 a valid signature still reports a key error without --lax-key-search.
• Without --id-attr for the ID attribute, the Reference #_a1b2c3 resolves to nothing and verification fails.
• --verify proves the signature, not the trust: it is only as good as the certificate you pass with --pubkey-cert-pem.

Run it on real machines