[JIRA] (SSPCPP-955) Add filter for <saml:advice> in assertions

Wed Aug 17 16:22:50 UTC 2022

Robbert van der Hoorn ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=62fb587bbb0704a2a808a380 ) *commented* on SSPCPP-955 ( https://shibboleth.atlassian.net/browse/SSPCPP-955?atlOrigin=eyJpIjoiOGNlOGQwYjE4NzgzNGY2Nzk2MDhiYzVkMTU0NWE0YWMiLCJwIjoiaiJ9 )

Re: Add filter for <saml:advice> in assertions ( https://shibboleth.atlassian.net/browse/SSPCPP-955?atlOrigin=eyJpIjoiOGNlOGQwYjE4NzgzNGY2Nzk2MDhiYzVkMTU0NWE0YWMiLCJwIjoiaiJ9 )

Hi Scott, thank you for your response. After repairing the issue with the syntax errors it works. <saml2:advice> is ignored now. But now we run into another problem. The provider eIDAS sends encrypted attributes in the response (artifact resolution). Attributes that are not encrypted show up when using the right mapping in attribute-map.xml. But the encrypted attributes cause this error in the log files:

ERROR Shibboleth.AttributeExtractor.XML [2] [default]: failed to decrypt Attribute: Unable to locate an encrypted key.

The message HAS encrypted keys in it.. I use extractNames="false" in my CredentialResolver.

The received saml message looks like (this is an example, not the real message, but the structure is the same):

<saml:EncryptedAttribute xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xenc=" http://www.w3.org/2001/04/xmlenc#%22 ( http://www.w3.org/2001/04/xmlenc#%22 ) >
<xenc:EncryptedData Id="_3a212d28-c468-35ed-bfc2-a58c61b9eb89" Type=" http://www.w3.org/2001/04/xmlenc#Element%22 ( http://www.w3.org/2001/04/xmlenc#Element%22 ) >
<xenc:EncryptionMethod Algorithm=" http://www.w3.org/2001/04/xmlenc#aes256-cbc%22/ ( http://www.w3.org/2001/04/xmlenc#aes256-cbc%22/ ) >
<ds:KeyInfo xmlns:ds=" http://www.w3.org/2000/09/xmldsig#%22 ( http://www.w3.org/2000/09/xmldsig#%22 ) >
[ds:KeyName|ds:KeyName] _59fdc1e5-f687-340e-92d0-524ba14d2242</ds:KeyName>
</ds:KeyInfo>
[xenc:CipherData|xenc:CipherData]
[xenc:CipherValue|xenc:CipherValue] zDAIGSqmq3CDGhHeP44Qc0OovuwskFKpg24Dog5sL3MsfagjBs3/WrGIIPt6lT90BlmQV4ohicpFl1uINbvVc4dW385yrq5JX3HxD9AXjsbhV4w7PCI1FlaCnlQhBAWKhyJL0UAl8HCTrM0peT5EaI+l4gP+a0QZ0x92jVol9thrz4KTCTxZdd1KQiRwaT+6sSxJAOn0Y4iWX4DHc46OP7O0bz1Gj4/yppgVFZHVl5IVCU7yVTfAKNqo/lD/HeBxhuhaaFGCW+/XIK+vXiAxYHxSE9fNZ3zXjIo03Ekm2Vem/RUbe98KbojRYtfI4CMB8VI6j2Qx7f8rpg9q0NznCrsBkGl4+wPeNbGfb4rBZA/a2i2a1hFqo41DKKCjCEyZh+VL/7ho27lNrJyzr48p0YRfHhGBmUuDKpxPT5i1jcUU4m7RMBxXa5ZNrfm/phigmW31H97UDoXxblIpmgk0P9PuRU2TORiQy6kKwj2GXpV/4BUEacRV4a/loW21sbBd</xenc:CipherValue>
</xenc:CipherData>
</xenc:EncryptedData>
<xenc:EncryptedKey Id="_8df79766-15ed-3575-97b0-dd44c977c6ac" Recipient="urn:etoegang:DV:00000003273785290000:entities:9072">
<xenc:EncryptionMethod Algorithm=" http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p%22 ( http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p%22 ) >
<ds:DigestMethod xmlns:ds=" http://www.w3.org/2000/09/xmldsig#%22 ( http://www.w3.org/2000/09/xmldsig#%22 ) Algorithm=" http://www.w3.org/2000/09/xmldsig#sha1%22/ ( http://www.w3.org/2000/09/xmldsig#sha1%22/ ) >
</xenc:EncryptionMethod>
<ds:KeyInfo xmlns:ds=" http://www.w3.org/2000/09/xmldsig#%22 ( http://www.w3.org/2000/09/xmldsig#%22 ) >
[ds:KeyName|ds:KeyName] 74932637AA115381FC27CF07CBDCF8DB43FA1BFB</ds:KeyName>
</ds:KeyInfo>
[xenc:CipherData|xenc:CipherData]
[xenc:CipherValue|xenc:CipherValue] d1Q+48avT6HOcopVe/o1fCFiS9Vsxm5sqJp97vo+VDDDK2fe3cW2CzbbNJ+6edALv0iII4Xqm8fbK5HyTXp+3q4idVhDjyqkZpqIB/WQD81ZxCLCRPcIrLQ1ecf/jVXOYq8r5JntM4/QP5GUll9NYUgggzLovqp4rcvUDS2VYBBsjlYjgDHMyftdHL/8BzrfI6TU7dQ9sfsJU1Wo2gVqp347LuvUhAlrU15HkjTOCVGC9jJMIQraFaqz1a/a6//r9tWLfrVuij98uNmP0Gd6nu68PwEJnNskWsOu10bk1oZ5SV+3B0aksL8QB7lbLUd6BctbkoI2Dtv1ePFi3hf1iA==</xenc:CipherValue>
</xenc:CipherData>
[xenc:ReferenceList|xenc:ReferenceList]
<xenc:DataReference URI="#_3a212d28-c468-35ed-bfc2-a58c61b9eb89"/>
</xenc:ReferenceList>
[xenc:CarriedKeyName|xenc:CarriedKeyName] _59fdc1e5-f687-340e-92d0-524ba14d2242</xenc:CarriedKeyName>
</xenc:EncryptedKey>
<xenc:EncryptedKey Id="_c0f43ad6-1a8b-31d3-a643-b50abdc9009f" Recipient="urn:etoegang:DV:00000003273785290000:entities:9072">
<xenc:EncryptionMethod Algorithm=" http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p%22 ( http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p%22 ) >
<ds:DigestMethod xmlns:ds=" http://www.w3.org/2000/09/xmldsig#%22 ( http://www.w3.org/2000/09/xmldsig#%22 ) Algorithm=" http://www.w3.org/2000/09/xmldsig#sha1%22/ ( http://www.w3.org/2000/09/xmldsig#sha1%22/ ) >
</xenc:EncryptionMethod>
<ds:KeyInfo xmlns:ds=" http://www.w3.org/2000/09/xmldsig#%22 ( http://www.w3.org/2000/09/xmldsig#%22 ) >
[ds:KeyName|ds:KeyName] preprod-NL-RVO-TVS-Polymorf.minez.nl</ds:KeyName>
</ds:KeyInfo>
[xenc:CipherData|xenc:CipherData]
[xenc:CipherValue|xenc:CipherValue] pirzLyvqjDb0upffw7xQdcjhohigNV6DWYA6lSPK9oZiQWpr9nnShi3FN4FzzKx39t4iVRgHusu0CUeQ2npEXZpZ13gPLu1Yk7vCVnKLnv6klZ/4lpiztpDsrduyq8dAUTBvirjpRWZILPhhyt13pkrK1dM9uzKEfyxgmMWUpapRgjabHJ5yOWTWxLYet+sM/0F7CCNBE/2YkfF/NUQjgsdsKVAKzyLMzOdg8TEokSjgk7AGbWU+XVmz3HZhgzmg2clqzhV4PoIKOfXaeRUiOlkhfmDHBk/TqHr4klMZiAHZXHyd4h/HPWxzWADbZCpXJtComMKuhfSIn3XImBMgmQ==</xenc:CipherValue>
</xenc:CipherData>
[xenc:ReferenceList|xenc:ReferenceList]
<xenc:DataReference URI="#_3a212d28-c468-35ed-bfc2-a58c61b9eb89"/>
</xenc:ReferenceList>
[xenc:CarriedKeyName|xenc:CarriedKeyName] _59fdc1e5-f687-340e-92d0-524ba14d2242</xenc:CarriedKeyName>
</xenc:EncryptedKey>
<xenc:EncryptedKey Id="_831b9e78-0032-38f9-8be2-957a5435b5d3" Recipient="urn:etoegang:DV:00000003273785290000:entities:9072">
<xenc:EncryptionMethod Algorithm=" http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p%22 ( http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p%22 ) >
<ds:DigestMethod xmlns:ds=" http://www.w3.org/2000/09/xmldsig#%22 ( http://www.w3.org/2000/09/xmldsig#%22 ) Algorithm=" http://www.w3.org/2000/09/xmldsig#sha1%22/ ( http://www.w3.org/2000/09/xmldsig#sha1%22/ ) >
</xenc:EncryptionMethod>
<ds:KeyInfo xmlns:ds=" http://www.w3.org/2000/09/xmldsig#%22 ( http://www.w3.org/2000/09/xmldsig#%22 ) >
[ds:KeyName|ds:KeyName] 8F18A776CD58C4B028942D9A2C82774851CD09A0</ds:KeyName>
</ds:KeyInfo>
[xenc:CipherData|xenc:CipherData]
[xenc:CipherValue|xenc:CipherValue] Hmy7gahjj6hSy17PVgmBUPV2yoax1oXRrU2f4DlsWvpwh5aQHx8kDxqXgdJ4AsoBgcL1dvJgoVzzrTH9hi9ccWig4As1/Uwlz333c6h+3xVMHluSHG+d1wnfFa5Y3Jjowk/tiq7ODOVqSi5oarzGINc3Fef8Pfj+3Ng0xVM32pjvf6CXQJHLzcsselpV4tt3EfiUOJJUOMUtpUPdOEFnaXn+uQj4pANdlYLFxb7coiDdKLzhE3zEVAnH10d+IZP+5UeWLr5YJoLKzCGbUKkX9NqonaHk9QZQBV1JGFg+t4Ke0O75glaAGlV0S4QrwzKgSv5S+00MdZlXh0qDQ2jx1Q==</xenc:CipherValue>
</xenc:CipherData>
[xenc:ReferenceList|xenc:ReferenceList]
<xenc:DataReference URI="#_3a212d28-c468-35ed-bfc2-a58c61b9eb89"/>
</xenc:ReferenceList>
[xenc:CarriedKeyName|xenc:CarriedKeyName] _59fdc1e5-f687-340e-92d0-524ba14d2242</xenc:CarriedKeyName>
</xenc:EncryptedKey>
</saml:EncryptedAttribute>

( https://shibboleth.atlassian.net/browse/SSPCPP-955#add-comment?atlOrigin=eyJpIjoiOGNlOGQwYjE4NzgzNGY2Nzk2MDhiYzVkMTU0NWE0YWMiLCJwIjoiaiJ9 ) Add Comment ( https://shibboleth.atlassian.net/browse/SSPCPP-955#add-comment?atlOrigin=eyJpIjoiOGNlOGQwYjE4NzgzNGY2Nzk2MDhiYzVkMTU0NWE0YWMiLCJwIjoiaiJ9 )

Get Jira notifications on your phone! Download the Jira Cloud app for Android ( https://play.google.com/store/apps/details?id=com.atlassian.android.jira.core&referrer=utm_source%3DNotificationLink%26utm_medium%3DEmail ) or iOS ( https://itunes.apple.com/app/apple-store/id1006972087?pt=696495&ct=EmailNotificationLink&mt=8 ) This message was sent by Atlassian Jira (v1001.0.0-SNAPSHOT#100204- sha1:f005d5a )
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/commits/attachments/20220817/83dd0c52/attachment-0001.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-comment-icon-5555aecc-2898-456c-bad6-2c7562241bfa
Type: image/png
Size: 1084 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220817/83dd0c52/attachment-0003.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-avatar-1b238207-51f3-4abe-96dc-793d0283e391
Type: image/png
Size: 457 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220817/83dd0c52/attachment-0004.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-footer-desktop-logo-e57dfd4e-30c4-412d-929f-bbbb644b93a3
Type: image/png
Size: 10805 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220817/83dd0c52/attachment-0005.png>