Wrong order of <Issuer> and <Signature> in SAML request/response

[jiri-janousek]

Specification

• Specification of RequestAbstractType (the base type for requests):

  <complexType name="RequestAbstractType" abstract="true">
  <sequence>
  <element ref="saml:Issuer" minOccurs="0"/>
  <element ref="ds:Signature" minOccurs="0"/>
  <element ref="samlp:Extensions" minOccurs="0"/>
  </sequence>
  ...
  </complexType>

• Specification of StatusResponseType (the base type for responses)

  <complexType name="StatusResponseType">
  <sequence>
  <element ref="saml:Issuer" minOccurs="0"/>
  <element ref="ds:Signature" minOccurs="0"/>
  <element ref="samlp:Extensions" minOccurs="0"/>
  <element ref="samlp:Status"/>
  </sequence>
  ...
  </complexType>

• Specification of AssertionType:

  <element name="Assertion" type="saml:AssertionType"/>
  <complexType name="AssertionType">
  <sequence>
  <element ref="saml:Issuer"/>
  <element ref="ds:Signature" minOccurs="0"/>
  <element ref="saml:Subject" minOccurs="0"/>
  <element ref="saml:Conditions" minOccurs="0"/>
  <element ref="saml:Advice" minOccurs="0"/>
  ...
  </sequence>
  ...
  </complexType>

Implementation

• eidas_node.xml.sign_xml_node(): New parameter position: int = 0 to specify the position of the signature.
• SAMLRequest.sign_request(), SAMLResponse.sign_response(), SAMLResponse.sign_assertion(): If <Issuer> element is present, insert signature after it.

[jiri-janousek]

Confirmed by NIA: Element 'Issuer' with namespace name 'urn:oasis:names:tc:SAML:2.0:assertion' was not found.