Decrypt SAML 2.0 Response

[Asaf Peter]

I am not sure. Attached the AuthenRequest I send to the IDP. Can you figure it out from this?

In the attribute-filter.xml on the IDP it says:

<AttributeFilterPolicy id="releaseToSP">
        <PolicyRequirementRule xsi:type="basic:AttributeRequesterString" value="http://sp.app.com/mng/login" />

        <AttributeRule attributeID="givenName">
            <PermitValueRule xsi:type="basic:ANY" />
        </AttributeRule>
        <AttributeRule attributeID="mail">
            <PermitValueRule xsi:type="basic:ANY" />
        </AttributeRule>
        <AttributeRule attributeID="uid">
            <PermitValueRule xsi:type="basic:ANY" />
        </AttributeRule>
        <AttributeRule attributeID="telephoneNumber">
            <PermitValueRule xsi:type="basic:ANY" />
        </AttributeRule>
        <AttributeRule attributeID="commonName">
            <PermitValueRule xsi:type="basic:ANY" />
        </AttributeRule>
    </AttributeFilterPolicy>



From: dev-bounces at shibboleth.net [mailto:dev-bounces at shibboleth.net] On Behalf Of Paul Hethmon
Sent: Monday, November 26, 2012 15:14
To: Shib Dev
Subject: Re: Decrypt SAML 2.0 Response

Do you know for certain that the IdP is sending you attribute statements? They are not required to be present.

Paul

From: Asaf Peter <Asaf.Peter at exlibrisgroup.com<mailto:Asaf.Peter at exlibrisgroup.com>>
Reply-To: Shibboleth Dev <dev at shibboleth.net<mailto:dev at shibboleth.net>>
Date: Monday, November 26, 2012 7:34 AM
To: Shibboleth Dev <dev at shibboleth.net<mailto:dev at shibboleth.net>>
Subject: Decrypt SAML 2.0 Response

Hi,

I get the attached  XML response from Shibboleth IDP:

I am trying to decrypt it using the following code:

 File keyStoreFile = new File("C:/Users/MyUser/my-private-key.pfx");
        String certAlias = "re-23d2gt1b-779r-39ez-1156-91b3f80eaee2";
        String password = "my_password";
        KeyStore keyStore = KeyStore.getInstance("PKCS12");
        keyStore.load(new FileInputStream(keyStoreFile), password.toCharArray());
        RSAPrivateKey privateKey = (RSAPrivateKey) keyStore.getKey(certAlias, password.toCharArray());
        BasicX509Credential decryptionCredential = new BasicX509Credential();
        decryptionCredential.setPrivateKey(privateKey);
        Decrypter decrypter = new Decrypter(null, new StaticKeyInfoCredentialResolver(decryptionCredential), new InlineEncryptedKeyResolver());
        Assertion decryptedAssertion;
        try {
            decryptedAssertion = decrypter.decrypt(response.getEncryptedAssertions().get(0)); // SUCCESS!!!
        }

The decryption seems to work now - no exception is thrown and I get the decryptedAssertion.
However, I cannot find the user id in the decryptedAssertion.
The decryptedAssertion.getAttributeStatements() returns an empty list.
Am I missing something?

Thanks,
Asaf
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/dev/attachments/20121126/82e137f1/attachment.html 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: AutheRequest.xml
Type: text/xml
Size: 938 bytes
Desc: AutheRequest.xml
Url : http://shibboleth.net/pipermail/dev/attachments/20121126/82e137f1/attachment.xml