search

crewjam / go-xmlsec

golang bindings for xmlsec
BSD 2-Clause "Simplified" License
26 stars 13 forks source link

Reference URI #12

Open gfyrag opened 7 years ago

gfyrag commented 7 years ago

hello,

i'm working on building an iDP and i use this library to generate signature. My SP for testing is a Giltab instance using the omniauth plugin. This plugin expect a valid "Reference" tag with an "URI" attribute, even if it is not mandatory by specification. So i plan to add this attribute on this library.

What i have done : 

type Signature struct {
    XMLName xml.Name `xml:"http://www.w3.org/2000/09/xmldsig# Signature"`

    CanonicalizationMethod Method `xml:"SignedInfo>CanonicalizationMethod"`
    SignatureMethod        Method `xml:"SignedInfo>SignatureMethod"`
    Reference              Reference `xml:"SignedInfo>Reference"`
    SignatureValue         string             `xml:"SignatureValue"`
    KeyName                string             `xml:"KeyInfo>KeyName,omitempty"`
    X509Certificate        *SignatureX509Data `xml:"KeyInfo>X509Data,omitempty"`
}

type Reference struct {
    XMLName             xml.Name `xml:"http://www.w3.org/2000/09/xmldsig# Reference"`
    ReferenceTransforms []Method `xml:"Transforms>Transform"`
    DigestMethod        Method   `xml:"DigestMethod"`
    DigestValue         string   `xml:"DigestValue"`
    URI                 string   `xml:",attr"`
}

Obvisouly, it works as expected with the Gitlab instance but it breaks compatibility of the client using this structure.

Any idea how to manage this?

crewjam commented 7 years ago

Reference probably should have been it's own struct from the beginning. It is probably better to rip the bandaid off... Can you submit a PR and we can see what breaks?