[JIRA] (IDP-1935) SAML2 Auth flow fails to decrypt when using overridden responder id.

[Janne Lauros (Jira)]

Janne Lauros ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=610d1440b704b4006828a384 ) *created* an issue

Identity Provider ( https://shibboleth.atlassian.net/browse/IDP?atlOrigin=eyJpIjoiNjc3YmEzNjBmOTc1NDY3OGJkYzUyZmRhYjMwOWI2NjIiLCJwIjoiaiJ9 ) / Bug ( https://shibboleth.atlassian.net/browse/IDP-1935?atlOrigin=eyJpIjoiNjc3YmEzNjBmOTc1NDY3OGJkYzUyZmRhYjMwOWI2NjIiLCJwIjoiaiJ9 ) IDP-1935 ( https://shibboleth.atlassian.net/browse/IDP-1935?atlOrigin=eyJpIjoiNjc3YmEzNjBmOTc1NDY3OGJkYzUyZmRhYjMwOWI2NjIiLCJwIjoiaiJ9 ) SAML2 Auth flow fails to decrypt when using overridden responder id. ( https://shibboleth.atlassian.net/browse/IDP-1935?atlOrigin=eyJpIjoiNjc3YmEzNjBmOTc1NDY3OGJkYzUyZmRhYjMwOWI2NjIiLCJwIjoiaiJ9 )

Issue Type: Bug Affects Versions: 4.1.5 Assignee: Unassigned Created: 05/Apr/22 12:55 PM Priority: Trivial Reporter: Janne Lauros ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=610d1440b704b4006828a384 )

* Setup IdP with SAML2 flow to upstream IdP. Setup upstream IdP to encrypt assertion.
* Verify SAML2 authentication works ok.
* Change the IdP global entity id propery to something else.
* Create the following override with values from step 1

<util:list id="shibboleth.RelyingPartyOverrides">
<bean parent="RelyingPartyByName" c:relyingPartyIds=" https://upstream-entity.com/idp "  p:responderId=" https://upstream-entity.com/sp ">
<property name="profileConfigurations">
<list>
<bean parent="SAML2.SSO" p:checkAddress="false" p:signAssertions="true"/>
</list>
</property>
</bean>
</util:list>

==> SAML2 authenticatio flow fails as it is not able to decrypt assertion anymore.

DEBUG [org.opensaml.saml.saml2.profile.impl.DecryptAssertions:121] - Profile Action DecryptAssertions: Decrypting EncryptedAssertion in Response
DEBUG [org.opensaml.xmlsec.encryption.support.ChainingEncryptedKeyResolver$ChainingIterator:225] - Getting key iterator from next resolver: class org.opensaml.xmlsec.encryption.support.InlineEncryptedKeyResolver
DEBUG [org.opensaml.xmlsec.encryption.support.ChainingEncryptedKeyResolver$ChainingIterator:225] - Getting key iterator from next resolver: class org.opensaml.saml.saml2.encryption.EncryptedElementTypeEncryptedKeyResolver
DEBUG [org.opensaml.xmlsec.encryption.support.ChainingEncryptedKeyResolver$ChainingIterator:225] - Getting key iterator from next resolver: class org.opensaml.xmlsec.encryption.support.SimpleRetrievalMethodEncryptedKeyResolver
DEBUG [org.opensaml.xmlsec.encryption.support.ChainingEncryptedKeyResolver$ChainingIterator:225] - Getting key iterator from next resolver: class org.opensaml.xmlsec.encryption.support.SimpleKeyInfoReferenceEncryptedKeyResolver
DEBUG [org.opensaml.xmlsec.encryption.support.ChainingEncryptedKeyResolver$ChainingIterator:228] - No more resolvers available in the resolver chain

( https://shibboleth.atlassian.net/browse/IDP-1935#add-comment?atlOrigin=eyJpIjoiNjc3YmEzNjBmOTc1NDY3OGJkYzUyZmRhYjMwOWI2NjIiLCJwIjoiaiJ9 ) Add Comment ( https://shibboleth.atlassian.net/browse/IDP-1935#add-comment?atlOrigin=eyJpIjoiNjc3YmEzNjBmOTc1NDY3OGJkYzUyZmRhYjMwOWI2NjIiLCJwIjoiaiJ9 )

Get Jira notifications on your phone! Download the Jira Cloud app for Android ( https://play.google.com/store/apps/details?id=com.atlassian.android.jira.core&referrer=utm_source%3DNotificationLink%26utm_medium%3DEmail ) or iOS ( https://itunes.apple.com/app/apple-store/id1006972087?pt=696495&ct=EmailNotificationLink&mt=8 ) This message was sent by Atlassian Jira (v1001.0.0-SNAPSHOT#100198- sha1:db0759e )
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/commits/attachments/20220405/8f31bdc0/attachment-0001.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-comment-icon-70c3c8bb-7a0d-4311-8bbf-2b5b9c59613b
Type: image/png
Size: 1084 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220405/8f31bdc0/attachment-0004.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-trivial-2517c050-09e7-4b2d-b443-315fe59edf9f
Type: image/png
Size: 563 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220405/8f31bdc0/attachment-0005.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-avatar-ed780f2a-18a4-4044-be89-ccd56992d316
Type: image/png
Size: 425 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220405/8f31bdc0/attachment-0006.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-footer-desktop-logo-982df27e-fda6-4dad-8147-bdcc8928545e
Type: image/png
Size: 10805 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220405/8f31bdc0/attachment-0007.png>