ASP.NET C# , "ID6018: Digest verification failed for reference"

[alban faverot]

Hello i have integrated the eID applet in a local intranet website
(ASP.NET C#) using
http://msdn.microsoft.com/en-us/library/ee517285.aspx

and using this metadata.xml
https://www.e-contract.be/eid-idp/endpoints/ws-federation/metadata/auth-ident-metadata.xml

when i open my website , it asks the Card , i fill the PIN code , i
see that authentication is done , and i get this error

Server Error in '/EID' Application.
--------------------------------------------------------------------------------
ID6018: Digest verification failed for reference '#assertion-8a5c8395-
ca60-4861-a69e-1898307c04dd'.

i have checked on internet and found something about ISA Server , but
we don't have ISA.
We use Websense for filtering , but we have removed all the filters
for this Server.

i don't find anything else to help me .

thanks for your help !

[Frank Cornelis]

Hi,

Seems like WIF cannot validate the XML signature correctly on the SAML message as received from the eID IdP.

Are you sure that the thumbprint within your Web.config matches the one found at:
https://www.e-contract.be/eid-idp/
?

Kind Regards,
Frank.
--
Verzonden van mijn Android telefoon met K-9 Mail.

alban faverot <al...@faverot.com> wrote:

Hello i have integrated the eID applet in a local intranet website (ASP.NET C#) using http://msdn.microsoft.com/en-us/library/ee517285.aspx and using this metadata.xml https://www.e-contract.be/eid-idp/endpoints/ws-federation/metadata/auth-ident-metadata.xml when i open my website , it asks the Card , i fill the PIN code , i see that authentication is done , and i get this error Server Error in '/EID' Application.

---

ID6018: Digest verification failed for reference '#assertion-8a5c8395- ca60-4861-a69e-1898307c04dd'. i have checked on internet and found something about ISA Server , but we don't have ISA. We use Websense for filtering , but we have removed all the filters for this Server. i don't find anything else to help me . thanks for your help ! -- You received this message because you are subscribed to the Google Groups "eID Applet" group. To post to this group, send email to eid-a...@googlegroups.com. To unsubscribe from this group, send email to eid-applet+...@googlegroups.com. For more options, visit this group at http://groups.google.com/group/eid-applet?hl=en.

[Alban FAVEROT]

Hello Frank ,

i did check , and it's the same.


i did test on another server at home , directly connected to my BBox , and i get the same error.

do you have any clue ?

---

From: "Frank Cornelis" <frank.c...@gmail.com>
Sent: 25 March 2011 11:35
To: eid-a...@googlegroups.com
Subject: Re: [eid-applet] ASP.NET C# , "ID6018: Digest verification failed for reference"

[Frank Cornelis]

Weird. Could you give me some information on the version of your OS, IIS, VisualStudio?
I'll try to have this one checked out as this could indicate an issue with the WS-Federation signature generation code of the eID IdP.

Kind regards,

Frank.
--
Verzonden van mijn Android telefoon met K-9 Mail.

[Alban FAVEROT]

Hello Frank, , thanks for your help .

The intranet is working on a Windows Server 2003 R2 SP2 , so IIS 6 i think
The visual studio 2008 , Release 9.0.30729.1 SP is installed on the server , and i developp on it because the WIF SDK or Runtime is not compatible with my XP64bits

Alban
Bulex Belgium

---

From: "Frank Cornelis" <frank.c...@gmail.com>

Sent: 26 March 2011 08:47

[alban faverot]

i see in your message that :

Besides the eID Applet we also offer an eID Identity Provider that
supports:
- WS-Federation 1.1 (for ASP.NET integration via WIF)

so maybe i'm confusing . i did use WIF , and it display also the
Applet.
So to use "eID Identity Provider for ASP.NET integration via WIF" , do
you have a process or screenshots ?

thanks

[Frank Cornelis]

Hi,

The eID IdP is of course using the eID Applet to perform the eID
authentication/identification crypto-operations.

The link you posted is the official documentation from Microsoft, so
couldn't do it better:
http://msdn.microsoft.com/en-us/library/ee517285.aspx

I once created a video about this:
http://www.youtube.com/watch?v=7AFGfWj7q5Q&hd=1
<http://www.youtube.com/watch?v=7AFGfWj7q5Q&hd=1>

Kind Regards,
Frank.

[Frank Cornelis]

Hi,


We did some tests and everything seems to be OK.
Can you try this out on a more recent version of Windows?


Kind Regards,
Frank.

[alban faverot]

I have installed a new Windows Server 2008 R2
IIS 6.1 (Build 7600)
WIF SDK for Framework 3.5 , and the runtime

[alban faverot]

i have installed the Framework 4.0 , the website runs under the
Framework 4.0
but something strange
in the web.config i see Microsoft.IdentityModel, Version=3.5.0
(automaticaly added using "Add STS"
but when i try to add a reference i find System.IdentityModel ,
Version 4.0 , but i receive an error "The website already has a
reference to the Assembly System.IdentityModel.

could you give me your web.config file to check ?

[Frank Cornelis]

Hi,

I've created a new video demonstrating the integration of eID IdP into
ASP.NET using Windows Identity Foundation 3.5.
This time all attributes are used and the eID IdP URL is up-to-date.

Check it out at: http://www.youtube.com/watch?v=ZxDrbZdTRLk&hd=1
<http://www.youtube.com/watch?v=ZxDrbZdTRLk&hd=1>

Kind Regards,
Frank.

[Frank Cornelis]

Hi Alban,

I don't think there is such a thing as WIF 4.0.

In attachment you'll find my web.config file. But you shouldn't use that
as is I guess, since the host/ports won't match for your deployment.

Kind Regards,
Frank.

On 04/05/2011 03:13 PM, alban faverot wrote:

[alban faverot]

the thumbprint was different so i changed it . idem , the same error.

i have changed my website because i was using a virtual directory. now
i type directly the default website http://vabedr04/
idem the same error.

i said to my boss that it's too easy to integrate it in a .Net
website .. i'm now a stupid boy

[fcorneli]

Hi Alban,


That's indeed some painful. Is your company close to FedICT? Maybe we
can arrange a meeting so we can figure out what is going wrong
exactly? Drop me a line at frank.cornelis at fedict.be


Kind Regards,
Frank.

On Apr 12, 3:32 pm, alban faverot <al...@faverot.com> wrote:
> the thumbprint was different so i changed it . idem , the same error.
>
> i have changed my website because i was using a virtual directory. now

> i type directly the default websitehttp://vabedr04/

[Frank Cornelis]

Hi Alban,


Try again... should be fixed now.


Kind Regards,
Frank.