[JIRA] (IDP-1935) SAML2 Auth flow fails to decrypt when using overridden responder id.

Tue Apr 5 17:26:15 UTC 2022

Scott Cantor ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A5b78efc9-1379-42cc-a3f6-56c6ea3a0007 ) *commented* on IDP-1935 ( https://shibboleth.atlassian.net/browse/IDP-1935?atlOrigin=eyJpIjoiZmFjNWQ3YWRjNjRmNGI3MWEzZmYxNzY2Njg3NTVlMDYiLCJwIjoiaiJ9 )

Re: SAML2 Auth flow fails to decrypt when using overridden responder id. ( https://shibboleth.atlassian.net/browse/IDP-1935?atlOrigin=eyJpIjoiZmFjNWQ3YWRjNjRmNGI3MWEzZmYxNzY2Njg3NTVlMDYiLCJwIjoiaiJ9 )

The issue is that the defaultEncryptedKeyResolver bean in relying-party-system.xml that wires up the various resolvers of keys from the message has a hard-wired reference to the entityID bean carrying the default value as the recipient to check for.

It appears to me that the APIs in this area of OpenSAML for resolving keys aren’t based on pluggable Criteria objects like a lot of the other resolvers Brent Putman ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A97de0981-adc3-4044-95ed-131622fad81e ) did, and the recipient values are statically defined on the resolver beans rather than fed in from outside.

As a workaround, it is possible to re-wire the relevant beans into an overridden SecurityConfiguration object’s decryptionConfiguration slot to point it at a different entityID. It’s not elegant, for sure.

One workaround might be to slap in some subclasses in the IdP that are lookup-strategy aware to handle this use case, unless/until we enhance the lower level APIs to accomodate a criterion-based approach.

( https://shibboleth.atlassian.net/browse/IDP-1935#add-comment?atlOrigin=eyJpIjoiZmFjNWQ3YWRjNjRmNGI3MWEzZmYxNzY2Njg3NTVlMDYiLCJwIjoiaiJ9 ) Add Comment ( https://shibboleth.atlassian.net/browse/IDP-1935#add-comment?atlOrigin=eyJpIjoiZmFjNWQ3YWRjNjRmNGI3MWEzZmYxNzY2Njg3NTVlMDYiLCJwIjoiaiJ9 )

Get Jira notifications on your phone! Download the Jira Cloud app for Android ( https://play.google.com/store/apps/details?id=com.atlassian.android.jira.core&referrer=utm_source%3DNotificationLink%26utm_medium%3DEmail ) or iOS ( https://itunes.apple.com/app/apple-store/id1006972087?pt=696495&ct=EmailNotificationLink&mt=8 ) This message was sent by Atlassian Jira (v1001.0.0-SNAPSHOT#100198- sha1:db0759e )
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/commits/attachments/20220405/69013ab7/attachment-0001.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-comment-icon-16c91bd2-68e9-4dd5-b02c-892edac24c95
Type: image/png
Size: 1084 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220405/69013ab7/attachment-0003.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-avatar-16c908f2-5c15-4a62-a7f6-6ef2b03378e0
Type: image/png
Size: 425 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220405/69013ab7/attachment-0004.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-footer-desktop-logo-d9c3a7cb-0c47-41d5-b208-2d68c1e6e684
Type: image/png
Size: 10805 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220405/69013ab7/attachment-0005.png>