[JIRA] Commented: (SSPCPP-474) Logger not logging events when processing EncryptedAttribute elements in SAML response

[Scott Cantor (JIRA)]

    [ https://issues.shibboleth.net/jira/browse/SSPCPP-474?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14281#comment-14281 ] 

Scott Cantor commented on SSPCPP-474:
-------------------------------------

Testing with release candidate 2.5 code, I get:

2012-07-24 11:19:08 ERROR Shibboleth.AttributeExtractor.XML : failed to decrypt
Attribute: Unable to resolve any key decryption keys.
2012-07-24 11:19:08 ERROR Shibboleth.AttributeExtractor.XML : failed to decrypt
Attribute: Unable to resolve any key decryption keys.
2012-07-24 11:19:08 ERROR Shibboleth.AttributeExtractor.XML : failed to decrypt
Attribute: Unable to resolve any key decryption keys.
2012-07-24 11:19:08 ERROR Shibboleth.AttributeExtractor.XML : failed to decrypt
Attribute: Unable to resolve any key decryption keys.
2012-07-24 11:19:08 ERROR Shibboleth.AttributeExtractor.XML : failed to decrypt
Attribute: Unable to resolve any key decryption keys.
2012-07-24 11:19:08 ERROR Shibboleth.AttributeExtractor.XML : failed to decrypt
Attribute: Unable to resolve any key decryption keys.
2012-07-24 11:19:08 ERROR Shibboleth.AttributeExtractor.XML : failed to decrypt
Attribute: Unable to resolve any key decryption keys.
2012-07-24 11:19:08 ERROR Shibboleth.AttributeExtractor.XML : failed to decrypt
Attribute: Unable to resolve any key decryption keys.

That's one for each encrypted attribute. I can't prove that it would process them after decryption since I don't have your key, but that demonstrates that it would log an error on the failure to decrypt.

I'll have to do further testing, but it's probable that I would need a sample from the IdP and a valid decryption key to prove anything for sure.

The key name problem remains in any case, so as a start you would need to disable the extractNames option in both this and the EncryptedAssertion cases as a starting point to get farther.

> Logger not logging events when processing EncryptedAttribute elements in SAML response
> --------------------------------------------------------------------------------------
>
>                 Key: SSPCPP-474
>                 URL: https://issues.shibboleth.net/jira/browse/SSPCPP-474
>             Project: Shibboleth SP - C++
>          Issue Type: Bug
>      Security Level: Standard(Standard bug, may impact functionality but does not represent a security vulnerability ) 
>          Components: SAML 2.0 Single Sign-On
>    Affects Versions: 2.3
>         Environment: External to Shibboleth
>            Reporter: rwhiten1 at idp.protectnetwork.org
>            Assignee: Scott Cantor
>            Priority: Minor
>              Labels: EncryptedAttribute
>         Attachments: CompleteSamlResponse.xml
>
>
> The partner we are working with is using IBM Tivoli IDP with encryption turned on.  This is IDP initiated SSO.  Their SAML responses contains encrypted attributes, encompassed in <saml:EncryptedAttribute> tags.  Shibboleth SP does not appear to decrypt the attributes, and also does not appear to log any events surrounding the decryption. Attached is the SAML response.

--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira