Spring Security SAML Extension, SAML Assertion Mangled, Signature Lost - spring-security

Question

i am using the following Spring Security 1.0.2.RELEASE sample code to get my SAML Assertion from Spring in a JSP (last code sample below). I am trying to do it just like in the SAMPLE app. I can see that my sp.xml and idp.xml are working correctly with PingIdentity which shows a well formed SAML Assertion in the logs (see Ping log assertions below). But when I look at the "token" variable below (see Spring code sample below), the signature value and the digest value are missing. ...the tags are still there in what otherwise looks like an OK SAML2 Assertion... ...but there are some essential values, like signature, missing even though ping actually did deliver these values. Strange, the IDs match, and also not included below, lots of roles from Ping to Spring are correctly displayed in the SAML Assertion "token" vaiable...
from ping:
2017-10-05 12:43:58,119 tid:fv0iEyiXUF5yhlB_-cZnExX0YTc DEBUG [org.sourceid.saml20.bindings.LoggingInterceptor] Transported Response. OutMessageContext:
OutMessageContext
XML: <samlp:Response Version="2.0" ID="F5FQ26j6o6VT0zNdZ4r87pDw8NT" IssueInstant="2017-10-05T10:43:58.072Z" InResponseTo="a1786b4f3g394b812f9edd3ca26c80g" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol">
<saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">app1</saml:Issuer>
<samlp:Status>
<samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/>
</samlp:Status>
<saml:Assertion ID="VmzXJoyk.9mxifAuyt4.WWi3F1O" IssueInstant="2017-10-05T10:43:58.103Z" Version="2.0" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">
<saml:Issuer>app1</saml:Issuer>
<ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
<ds:SignedInfo>
<ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
<ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/>
<ds:Reference URI="#VmzXJoyk.9mxifAuyt4.WWi3F1O">
<ds:Transforms>
<ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
<ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
</ds:Transforms>
<ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
<ds:DigestValue>ZnT3MW5R1Nm9y/Pe8Br5m1BXXbXTc0VWeIIkUGyJaOI=</ds:DigestValue>
</ds:Reference>
</ds:SignedInfo>
<ds:SignatureValue>bHPhuD09Q2az7TxBvJo2LavF2N5YaroZoCNZzG17iJmSVycv0Gfq3liSKb2yIPhY0I9WVr8WwM/N
dw720okdsEuIbzuy/NYOlOCB3sFaZ6GmmU0FruUHyqjTjGOxHA6504KpvVQjEg3D5iJeNTovKtQR
tICvKjT4Hv9qTE3tg1viWTnih3xFM++gPffHhfKwWHjXMJTpyy5oQaviYUlQw7Elgv0cyN9ni/jJ
lFWC0QJJYXK8BwDdyY4MOqvTz8F4DgBnkwAQ+TnPUwuCRDL0ckW84knrWAh4qz18bQzVjSBpT+AI
7i6NiQ/1L/YnoRvRJ3EttAKUTEO3YrtkJPxcxQ==</ds:SignatureValue>
</ds:Signature>
<saml:Subject>
from spring (value of "token" below):
<?xml version="1.0" encoding="UTF-8"?>
<saml:Assertion xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" ID="VmzXJoyk.9mxifAuyt4.WWi3F1O" IssueInstant="2017-10-05T10:43:58.103Z" Version="2.0" xmlns:xs="http://www.w3.org/2001/XMLSchema">
<saml:Issuer>app1</saml:Issuer>
<ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
<ds:SignedInfo>
<ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
<ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/>
<ds:Reference URI="#VmzXJoyk.9mxifAuyt4.WWi3F1O">
<ds:Transforms>
<ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
<ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#">
<ec:InclusiveNamespaces xmlns:ec="http://www.w3.org/2001/10/xml-exc-c14n#" PrefixList="xs"/>
</ds:Transform>
</ds:Transforms>
<ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
<ds:DigestValue/>
</ds:Reference>
</ds:SignedInfo>
<ds:SignatureValue/>
</ds:Signature>
spring security code:
<%# page import="org.springframework.security.saml.SAMLCredential"%>
<%# page import="org.springframework.security.core.context.SecurityContextHolder"%>
<%# page import="org.springframework.security.core.Authentication"%>
<%# page import="org.opensaml.saml2.core.Attribute"%>
<%# page import="org.springframework.security.saml.util.SAMLUtil"%>
<%# page import="org.opensaml.xml.util.XMLHelper"%>
(...)
Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
SAMLCredential credential = (SAMLCredential) authentication.getCredentials();
(...)
String token = XMLHelper.nodeToString(SAMLUtil.marshallMessage(credential.getAuthenticationAssertion()));

Answer 1

added this and got my signature back. what sayest thou who knoweth mein user errors?
<bean id="webSSOprofileConsumer" class="org.springframework.security.saml.websso.WebSSOProfileConsumerImpl">
<property name="releaseDOM" value="false" />
</bean>
..added to Spring Security SAML Extenion file "securityContext.xml"