Enveloped-signature transform not working?

[ryanhoffman-well]

Hello, for me it seems the enveloped-signature transform is not working

I have:

    sig.addReference({
      xpath: "//*[local-name()='Assertion']",
      digestAlgorithm: 'http://www.w3.org/2001/04/xmlenc#sha256',
      transforms: ['http://www.w3.org/2000/09/xmldsig#enveloped-signature'],
    });
    sig.canonicalizationAlgorithm = 'http://www.w3.org/2001/10/xml-exc-c14n#';
    sig.signatureAlgorithm = 'http://www.w3.org/2001/04/xmldsig-more#rsa-sha256';
    sig.computeSignature(this.xml);
    this.xml = sig.getSignedXml();

It computes a signature, however the Signature element is set after the Assertion element instead of within it as expected when using the enveloped-signature transform.

...</saml2:AttributeStatement>
      </saml2:Assertion>
    <Signature xmlns="http://www.w3.org/2000/09/xmldsig#">...

I've verified the xpath to locate to the correct element - it selects the Assertion element in the SAML response.

[srd90]

You have to add location for computeSignature. See e.g.

• How do we test locally or in a non-integrated environment? passport-saml#836 (comment)

Also notice that you have to add explicitly some C14N algorithm otherwise xml-crypto doesn't apply any implicit while other libraries seems to apply see #212 (comment)

[srd90]

See also xml-crypto documentation (link points to 6.0.0 version) about "How to specify the location of the signature": https://github.com/node-saml/xml-crypto/blob/0ed7ab2681af7e13defa055f5670bad9adad927b/README.md#how-to-specify-the-location-of-the-signature

[ryanhoffman-well]

Oof TY! 🙏