Decrypt SAML 2.0 Response

[Asaf Peter]

Hi Paul,

How do I turn off encryption?

Thanks,
Asaf

From: dev-bounces at shibboleth.net [mailto:dev-bounces at shibboleth.net] On Behalf Of Paul Hethmon
Sent: Monday, November 26, 2012 15:30
To: Shib Dev
Subject: Re: Decrypt SAML 2.0 Response

Asaf,

That all looks ok. One thing that sticks out to me is that you are requesting an AuthnContextClassRef of PasswordProtectedTransport. If the IdP does not have that available, then you may not get anything back but an error message. A few suggestions:

1. Turn off encryption if you can. Get it working in the simple case before the hard.
2. If you have access to the IdP server logs, turn up logging to DEBUG and see what the logs say. They will tell you exactly what attributes it resolved and which ones it will send (or won't send) to the SP.
3. Turn on debugging on your side and log the SAML XML. Take a look at it and see what it says after you decrypt it.

Paul

From: Asaf Peter <Asaf.Peter at exlibrisgroup.com<mailto:Asaf.Peter at exlibrisgroup.com>>
Reply-To: Shibboleth Dev <dev at shibboleth.net<mailto:dev at shibboleth.net>>
Date: Monday, November 26, 2012 8:21 AM
To: Shibboleth Dev <dev at shibboleth.net<mailto:dev at shibboleth.net>>
Subject: RE: Decrypt SAML 2.0 Response

I am not sure. Attached the AuthenRequest I send to the IDP. Can you figure it out from this?

In the attribute-filter.xml on the IDP it says:

<AttributeFilterPolicy id="releaseToSP">
        <PolicyRequirementRule xsi:type="basic:AttributeRequesterString" value="http://sp.app.com/mng/login" />

        <AttributeRule attributeID="givenName">
            <PermitValueRule xsi:type="basic:ANY" />
        </AttributeRule>
        <AttributeRule attributeID="mail">
            <PermitValueRule xsi:type="basic:ANY" />
        </AttributeRule>
        <AttributeRule attributeID="uid">
            <PermitValueRule xsi:type="basic:ANY" />
        </AttributeRule>
        <AttributeRule attributeID="telephoneNumber">
            <PermitValueRule xsi:type="basic:ANY" />
        </AttributeRule>
        <AttributeRule attributeID="commonName">
            <PermitValueRule xsi:type="basic:ANY" />
        </AttributeRule>
    </AttributeFilterPolicy>



From: dev-bounces at shibboleth.net<mailto:dev-bounces at shibboleth.net> [mailto:dev-bounces at shibboleth.net] On Behalf Of Paul Hethmon
Sent: Monday, November 26, 2012 15:14
To: Shib Dev
Subject: Re: Decrypt SAML 2.0 Response

Do you know for certain that the IdP is sending you attribute statements? They are not required to be present.

Paul

From: Asaf Peter <Asaf.Peter at exlibrisgroup.com<mailto:Asaf.Peter at exlibrisgroup.com>>
Reply-To: Shibboleth Dev <dev at shibboleth.net<mailto:dev at shibboleth.net>>
Date: Monday, November 26, 2012 7:34 AM
To: Shibboleth Dev <dev at shibboleth.net<mailto:dev at shibboleth.net>>
Subject: Decrypt SAML 2.0 Response

Hi,

I get the attached  XML response from Shibboleth IDP:

I am trying to decrypt it using the following code:

 File keyStoreFile = new File("C:/Users/MyUser/my-private-key.pfx");
        String certAlias = "re-23d2gt1b-779r-39ez-1156-91b3f80eaee2";
        String password = "my_password";
        KeyStore keyStore = KeyStore.getInstance("PKCS12");
        keyStore.load(new FileInputStream(keyStoreFile), password.toCharArray());
        RSAPrivateKey privateKey = (RSAPrivateKey) keyStore.getKey(certAlias, password.toCharArray());
        BasicX509Credential decryptionCredential = new BasicX509Credential();
        decryptionCredential.setPrivateKey(privateKey);
        Decrypter decrypter = new Decrypter(null, new StaticKeyInfoCredentialResolver(decryptionCredential), new InlineEncryptedKeyResolver());
        Assertion decryptedAssertion;
        try {
            decryptedAssertion = decrypter.decrypt(response.getEncryptedAssertions().get(0)); // SUCCESS!!!
        }

The decryption seems to work now - no exception is thrown and I get the decryptedAssertion.
However, I cannot find the user id in the decryptedAssertion.
The decryptedAssertion.getAttributeStatements() returns an empty list.
Am I missing something?

Thanks,
Asaf
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/dev/attachments/20121126/dec863cb/attachment-0001.html