The part of SAML which you need to verify the x.509 signature is XMLSec. This example (in C) illustrates how to use the C library to do this. Unfortunately, there aren't any perl bindings (yet) for this library (though the author is open to the idea).

Parsing the values out of the XML document is, as you say, the easy part ...

Thanks for taking the time to straighten me out. Conceptually, can't I just take the following steps

Use crypt:x509 to decipher certificate
Pull out the public key piece
Use the public key with the MD5 HASH to verify the signature?

That is the best I can get from the documentation.

If you don't want to build your own SAML. Check out AssureBridge SSOExchange. It's a hosted service that integrates into Perl Apps with a few lines of code and provides full SAML functionality. http://www.assurebridge.com/integrations/

Did you find the information at http://zxid.org/?

That is where I started. The site does not have any concrete examples (that I have come across). I need to gather the x509 certificate and verify the signature. Then I need to pull out the attributes. I may be making things very simplistic, but I may be able to do this with out specific SAML functions. All I need to do is find a function to decipher a signature. THe XML parsing is easy. I was hoping someone would say - use this function and that function and you are all set.

http://zxid.org/zxid-0.17.tgz includes zxid.pl which may or may not help.

---

DWIM is Perl's answer to Gödel

I don't even know what SAML is, but i do notice that the POD for Net::SAML says "Consult zxid/README.zxid for detailed API descriptions. This pod is only a place holder - real documentation is in the README.zxid file.

I have tried Net::SAML and I can not even get it to make. I am not very experienced when it comes to manually making the files (I just use CPAN). The compressed file comes with Makefile not Makefile.PL. I tried to just rename it and run and it did not work. The documentation said this has only been tested on a Linux platform - I am on FreeBSD. No luck so far. I have tried to brute force it by using crypt::x509 to decipher the cert, but I have not had any luck with that either.

The process may be a little different depending on whether you are trying to parse a Service Provider issued SAML AuthnRequest or an Identity Provider issued SAMLResponse

An AuthnRequest will typically be rawdeflated ( IO::Compress::RawDeflate::rawdeflate ), Base64 encoded ( MIME::Base64::encode_base64 ), and URI encoded ( URI::Escape::uri_escape ).

To parse a SAML AuthnRequest you need to process the data in reverse.

Here is a simple example. Note: This example does not verify the digital signature of the AuthnRequest (if it exists).

use warnings;
use strict;
use MIME::Base64               qw(encode_base64 decode_base64);
use URI::Escape                qw(uri_escape uri_unescape);
use IO::Uncompress::RawInflate qw(rawinflate $RawInflateError);

my $AuthnRequestXML = '';
my $samlRequest = 'BASE64_ENCODED_SAMLREQUEST_FROM_SERVICE_PROVIDER';
$samlRequest = uri_unescape($samlRequest);
$samlRequest = decode_base64($samlRequest);
rawinflate \$samlRequest => $AuthnRequestXML or return "Error decompre
+ssing data: $RawInflateError\n";
print "SAML AuthnRequest XML:\n$AuthnRequestXML\n";
[download]

use XML::Tidy;
XML::Tidy->new('xml'=>$AuthnRequestXML)->tidy()->toString();
[download]