Hi,
I'm having an issue getting the SAML2 response to decrypt. It all works
when it's just signed but once I enable encryption I can't decrypt the
assertions from the client. I'm using opensaml from java and below is the
method I'm using to decrypt. The credentials are built from a keystore
which I exported my public key from that I have in the metadata file. I
have used this code before with other IdP's. I've also included the log
messages below, metadata file and service provider files. Any help would
be greatly appreciated.
public static Assertion decryptEncryptedAssertion(EncryptedAssertion
encryptedAssertion, Credential credentials) throws DecryptionException,
CertificateException, IOException {
StaticKeyInfoCredentialResolver staticKeyResolver = new
StaticKeyInfoCredentialResolver(credentials);
InlineEncryptedKeyResolver inlineEncryptedKeyResolver = new
InlineEncryptedKeyResolver();
Decrypter decrypter = new Decrypter(null, staticKeyResolver,
inlineEncryptedKeyResolver);
return decrypter.decrypt(encryptedAssertion);
}
DEBUG
[org.apereo.cas.support.saml.web.idp.profile.builders.enc.SamlObjectEncrypter]
- <Attempting to encrypt [org.opensaml.saml.saml2.core.impl.AssertionImpl]
for [http://172.24.98.169:8080/saml_test2]>
2017-01-17 10:51:06,398 DEBUG
[org.apereo.cas.support.saml.web.idp.profile.builders.enc.SamlObjectEncrypter]
- <Encryption blacklisted algorithms:
[[http://www.w3.org/2001/04/xmlenc#rsa-1_5]]>
2017-01-17 10:51:06,398 DEBUG
[org.apereo.cas.support.saml.web.idp.profile.builders.enc.SamlObjectEncrypter]
- <Encryption key algorithms:
[[http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p,
http://www.w3.org/2001/04/xmlenc#kw-aes128,
http://www.w3.org/2001/04/xmlenc#kw-aes192,
http://www.w3.org/2001/04/xmlenc#kw-aes256,
http://www.w3.org/2001/04/xmlenc#kw-tripledes]]>
2017-01-17 10:51:06,398 DEBUG
[org.apereo.cas.support.saml.web.idp.profile.builders.enc.SamlObjectEncrypter]
- <Signature data algorithms:
[[http://www.w3.org/2001/04/xmlenc#aes128-cbc,
http://www.w3.org/2001/04/xmlenc#aes192-cbc,
http://www.w3.org/2001/04/xmlenc#aes256-cbc,
http://www.w3.org/2001/04/xmlenc#tripledes-cbc]]>
2017-01-17 10:51:06,399 DEBUG
[org.apereo.cas.support.saml.web.idp.profile.builders.enc.SamlObjectEncrypter]
- <Encryption whitelisted algorithms: []>
2017-01-17 10:51:06,497 DEBUG
[org.apereo.cas.support.saml.web.idp.profile.builders.enc.SamlObjectEncrypter]
- <Locating encryption key file from [/etc/cas/saml/idp-encryption.key]>
2017-01-17 10:51:06,497 DEBUG
[org.apereo.cas.util.crypto.PrivateKeyFactoryBean] - <Attempting to read
/etc/cas/saml/idp-encryption.key as PEM>
2017-01-17 10:51:06,536 DEBUG
[org.apereo.cas.support.saml.web.idp.profile.builders.enc.SamlObjectEncrypter]
- <Locating encryption certificate file from
[/etc/cas/saml/idp-encryption.crt]>
2017-01-17 10:51:06,537 DEBUG
[org.apereo.cas.support.saml.web.idp.profile.builders.enc.SamlObjectEncrypter]
- <Created encryption credential>
2017-01-17 10:51:06,539 DEBUG
[org.apereo.cas.support.saml.web.idp.profile.builders.enc.SamlObjectEncrypter]
- <Attempting to resolve the encryption key for entity id
[http://172.24.98.169:8080/saml_test2]>
2017-01-17 10:51:06,539 DEBUG
[org.apereo.cas.support.saml.web.idp.profile.builders.enc.SamlObjectEncrypter]
- <Key encryption algorithm for [http://172.24.98.169:8080/saml_test2] is
[http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p]>
2017-01-17 10:51:06,540 DEBUG
[org.apereo.cas.support.saml.web.idp.profile.builders.enc.SamlObjectEncrypter]
- <Data encryption algorithm for [http://172.24.98.169:8080/saml_test2] is
[http://www.w3.org/2001/04/xmlenc#aes128-cbc]>
2017-01-17 10:51:06,545 DEBUG
[org.apereo.cas.support.saml.web.idp.profile.builders.enc.SamlObjectEncrypter]
- <Attempting to encrypt [org.opensaml.saml.saml2.core.impl.AssertionImpl]
for [http://172.24.98.169:8080/saml_test2] with key placement of [PEER]>
2017-01-17 10:51:06,599 DEBUG
[org.apereo.cas.support.saml.web.idp.profile.builders.SamlProfileSamlResponseBuilder]
- <Built assertion is encrypted, so the response will add it to the
encrypted assertions collection>
<?xml version="1.0" encoding="UTF-8"?>
<EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata"
xmlns:ds="http://www.w3.org/2000/09/xmldsig#";
xmlns:shibmd="urn:mace:shibboleth:metadata:1.0"
xmlns:xml="http://www.w3.org/XML/1998/namespace";
xmlns:mdui="urn:oasis:names:tc:SAML:metadata:ui"
entityID="http://172.24.98.169:8080/saml_test2";>
<SPSSODescriptor
protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
<Extensions>
<shibmd:Scope
regexp="false">http://172.24.98.169:8080/saml_test2</shibmd:Scope>
</Extensions>
<KeyDescriptor use="signing">
<ds:KeyInfo>
<ds:X509Data>
<ds:X509Certificate>
---- My Public Cert ----
</ds:X509Certificate>
</ds:X509Data>
</ds:KeyInfo>
</KeyDescriptor>
<KeyDescriptor use="encryption">
<ds:KeyInfo>
<ds:X509Data>
<ds:X509Certificate>
---- My Public Cert ----
</ds:X509Certificate>
</ds:X509Data>
</ds:KeyInfo>
</KeyDescriptor>
<NameIDFormat>urn:mace:shibboleth:1.0:nameIdentifier</NameIDFormat>
<NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</NameIDFormat>
<SingleLogoutService
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
Location="https://cas.morleyweb.com:8443/cas/idp/profile/SAML2/POST/SLO"/>
<SingleSignOnService
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
Location="https://cas.morleyweb.com:8443/cas/idp/profile/SAML2/POST/SSO"/>
<SingleSignOnService
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"
Location="https://cas.morleyweb.com:8443/cas/idp/profile/SAML2/Redirect/SSO"/>
<AssertionConsumerService
isDefault="true"
index="0"
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact"
Location="http://172.24.98.169:8080/saml_test2/sso"/>
</SPSSODescriptor>
</EntityDescriptor>
{
@class: org.apereo.cas.support.saml.services.SamlRegisteredService
serviceId: ^http://172.24.98.169:8080/saml_test2
name: SAMLTest
id: 3032504042888199
description: SAML Testing
evaluationOrder: 1
logoutType: NONE
attributeReleasePolicy:
{
@class: org.apereo.cas.services.ReturnAllAttributeReleasePolicy
principalAttributesRepository:
{
@class:
org.apereo.cas.authentication.principal.DefaultPrincipalAttributesRepository
expiration: 2
timeUnit: HOURS
}
authorizedToReleaseCredentialPassword: false
authorizedToReleaseProxyGrantingTicket: false
}
multifactorPolicy:
{
@class:
org.apereo.cas.services.DefaultRegisteredServiceMultifactorPolicy
failureMode: CLOSED
}
accessStrategy:
{
@class: org.apereo.cas.services.DefaultRegisteredServiceAccessStrategy
enabled: true
ssoEnabled: true
requireAllAttributes: false
caseInsensitive: false
}
metadataLocation: /etc/cas/saml/saml_test2.xml
metadataMaxValidity: 0
signAssertions: false
signResponses: true
encryptAssertions: true
metadataCriteriaRoles: SPSSODescriptor
metadataCriteriaRemoveEmptyEntitiesDescriptors: false
metadataCriteriaRemoveRolelessEntityDescriptors: false
}
--
- CAS gitter chatroom: https://gitter.im/apereo/cas
- CAS mailing list guidelines: https://apereo.github.io/cas/Mailing-Lists.html
- CAS documentation website: https://apereo.github.io/cas
- CAS project website: https://github.com/apereo/cas
---
You received this message because you are subscribed to the Google Groups "CAS
Community" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion on the web visit
https://groups.google.com/a/apereo.org/d/msgid/cas-user/b66a03c4-e1ba-4335-a6ff-b34cfcb325ed%40apereo.org.
