Decrypting an assertion

[Brent Putman]

On 10/21/12 12:24 PM, rangeli nepal wrote:
> However program fails with following message:
>
> org.opensaml.xml.encryption.DecryptionException: Failed to decrypt EncryptedData
>         at org.opensaml.xml.encryption.Decrypter.decryptDataToDOM(Decrypter.java:523)
>         at org.opensaml.xml.encryption.Decrypter.decryptDataToList(Decrypter.java:439)
>         at org.opensaml.xml.encryption.Decrypter.decryptData(Decrypter.java:400)
>         at org.opensaml.saml2.encryption.Decrypter.decryptData(Decrypter.java:140)
>         at org.opensaml.saml2.encryption.Decrypter.decrypt(Decrypter.java:68)
>         at com.mountaintop.saml.AssertionDecryptor.decryptAssertion(AssertionDecryptor.java:55)


Turning up to DEBUG logging would probably provide some more useful
info, but I think I see the problem...



>
>
>                 samlEncrypter.setKeyPlacement(KeyPlacement.PEER);
>

On encryption, you're specifying key placement as PEER (versus INLINE).



>                 Decrypter samlDecrypter =
>                   new Decrypter(null, skicr, new InlineEncryptedKeyResolver());
>


On decryption, you're specifying (only) an inline EncryptedKey resolver.


Your problem is: the latter isn't going to find the EncryptedKey placed
by the former.  Please read the Javadocs on PEER vs INLINE key placement
and the various EncryptedKeyResolver impls.  Your options are:

1) instead use INLINE key placement

2) instead use the EncryptedElementTypeEncryptedKeyResolver (which is
appropriate for PEER key placement)

3) (best for real world) Since you may not be able to make assumptions
about where the key is placed by whoever encrypted it, just use a 
ChainingEncryptedKeyResolver with all the EncryptedKeyResolver impls to
cover all the bases, as illustrated in the more complex decryption
example in the wiki.




-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/dev/attachments/20121024/4b9966da/attachment.html