SAML key info configuration

Thu Jun 6 11:07:34 EDT 2013

Hi all,

I'm looking to ask a question about opensaml and was told that this is the
place to do so.

My team is using opensaml 2.5.3 to generate saml tokens for a project we
are working on. Currently, our SAML token's look like this:

<?xml version="1.0" encoding="UTF-8"?>

<saml2p:Response xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol"

Destination="destination location"

Version="2.0">

<saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"

xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"

xsi:schemaLocation="urn:oasis:names:tc:SAML:2.0:assertion">
our.schema.location.com</saml2:Issuer>

<ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">

<ds:SignedInfo>

<ds:CanonicalizationMethod Algorithm="
http://www.w3.org/2001/10/xml-exc-c14n#" />

<ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1
" />

<ds:Reference URI="">

<ds:Transforms>

<ds:Transform

Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" />

<ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />

</ds:Transforms>

<ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" />

<ds:DigestValue>rocEKkS/8cZ/My3cEPFtURhSW/Y=</ds:DigestValue>

</ds:Reference>

</ds:SignedInfo>

<ds:SignatureValue>U1aGdRLm4GmQiNkD/W9ORZLoNpiv1yOsYoad+XveRT4HqDG+UpigMImSYRI7wGTDGHkeK1noy3jusEhNzzBIT91lGjrrFyuSkDFMBetrdmJJFeDGCQ5s60iD6OFhlkhSB4iCgaTRtBvT44ligFGHeJuLfXlL7qyGkiROCF4mjAVjmhj97TCQS+xJhKVkfEFgIdBGlXTYZFiAz090SElzRClQIcozT4+SJRkLRL3GrcWqX1awRm826DPoMAZri9f1qjqFFYL7zpbAQScaezi8DxbvziLRJykp11hKnau2EoWp9o627XgDvD5Bvu7Fa95J3wuzTZHaRcRuY/t+tzJpaA==

</ds:SignatureValue>

</ds:Signature>

<saml2p:Status>

<saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" />

</saml2p:Status>

<saml2:EncryptedAssertion xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">

<xenc:EncryptedData xmlns:xenc="http://www.w3.org/2001/04/xmlenc#"

Id="_a04f85fb05fda175a5e7eba026640f16" Type="
http://www.w3.org/2001/04/xmlenc#Element">

<xenc:EncryptionMethod Algorithm="
http://www.w3.org/2001/04/xmlenc#aes128-cbc"

xmlns:xenc="http://www.w3.org/2001/04/xmlenc#" />

<ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">

<ds:RetrievalMethod Type="http://www.w3.org/2001/04/xmlenc#EncryptedKey"

URI="#_9b07dd8a259d8ee8162adf17cd761d34" />

</ds:KeyInfo>

<xenc:CipherData xmlns:xenc="http://www.w3.org/2001/04/xmlenc#">

<xenc:CipherValue>mGrwQumPCnQotiGSzCQbmG5V3e2pipVwYlesoLEsesmSWGxJ5AjXTOvLZeY35qeTv4/UYSLGq1v3QyBDmXLccdfztYsZfHAqau9oh4alyF/uC+h0SIW03gnlKJQ1XabCy0qIqBj6W3xqKzRAwlqC7uL34LqbBaoFIcl6SCf2Bime7zQVN/eU0vWXefFetlrMA6at51UdFvEUe37MAORoK54LdP5QB6LR5PatORwQ+XupsGV4fs9x0fTJdQ+S1sjJnOZ9K7Kau8zFxy2Y4KIMybzIwMTZzun95QRJczWcArOYVo8VueqsmveUAKMjt3XPYQl4YoIrLk7k6fCNi1CLw5VVDmHxaBAXVMA7jOwbPPZYHIYkMXEMZmcpGewtj8a0WDTwgQpA1Mhzvyfn90PHhQaWb9zfPaXqredKVY8n/VK1UhghSMlnByVJNz5KFyQLD8FoFpYORuPvU7szrOSTO3/MO6NA7n4/dvgbBnqCjFaJaBhyFOBjrvslZ8+O3jSZbX+Y2GVgpfNEwjmoqsw+tPeg55cAHjE3fv9rewkkLpQ1EE+TlHE0MXKMCmqoblp0wSt5iWN0EJSmKiNA7caZVcABZHx+eZ/lmr33E00WAQovgoShenXg96rZLREu+Fa+yP/GEruiuX0+Co6+qdY9cFLebtWy/cimKixV37Lnz07+WBEGNlJNj8NdWuDN5cvdaZzEJtNdhduLbvwShtQuyrL4DIesLCt5LHmRLuahVCAyVoeE0cjnBz+/57k7G9kTGys0EnVP2TKfHP3sAsAQ3PneGgxSurZLLGuJZQz6fRLmZXGH2hXZ/lEQYH1nNl0udVTDOPD/nki8G7SmXvGV+oyLyGjnNyIfgeUCbCD28sEthIQK3g15+vxeBlY4k6HicgcoEayOOAMkd4uhwz8ffxHP5M3iM2KHqR6Fu61IiUrTSjhAlocW1wu2RS0ueTBzHV56Iv+WgSawyWQrTXDSR1C0k8b4twh8PDeQRuSMsYfsrP8je1dIlRC/a+t2flasTYSvfb+U0ks/ubBTXa7rmkhl2+63QX375v5c4R9vsRMUmv3HNmXiluFxx9cSrNzYgS+8J2/vEtLumr48vnz1kGN5OiPbyP8eDanGvSKXBDeglc4d+EfxaVgp3Xc7RpzM8MIsKtPMP+kUoXq0JMvasU9biyzB00f0b3+1bEDOIG5x/xqvtPyXPZJ+vZC/MjHqq559BBlEd7Qaes4v+xUfP1w3Cn1sf1iSNud+JBQNpPP2suQL5Kyun0W5x50HxyVl2aG1GAq0DnGgIP+3jPhaHnYr6XIzhua1ZOJ3ZwkNcyeJ9PwCTmoKywJU1S0cQ61/dfxxssXR+2xEpu7JBukzrZ6DenUJ+352u+M0rigXXDoyQqWQGgnXOTiyJ5VfVVSn/HEoUHA1Gi5DX1EWNeIeOz14rUstMCkfl0JOacZKgefjPupYVqzCUuVb/OVi7UpMlwaFiloyj8MVJOf70p9s9NhoNMbA/TZc61wNSWfJl2rY7StbCsCtXHy9gq1W1loL16A+mngXRn9Fii4n1WIjiwY8iuBTRsWDCg/n5W5b5ke4gkmMnsVLeKJG218w9qVHeGbQ8MQSGCEatYTrMqjoqcJgxYm+E7JfXvfibDpQrAJlExyMdr4YcxUOXjgywdbySd4HQT5ZYgp9r+jwK5JFzjlWQhjtTc/1A4YnPfu/IKiU3r4xE7Hjud3DEEpHlwsSCmMMaN+5+M1+/ZUg5A6GPZ2fAfYe+QW8Bhj9WtoKR8RY3gia/v+IcQELR8/WW7y7D3bmRtUATPSzSGtwSdJoyg2hf/ZEazzpZNqwP+W3Vdgwh9hVX3K9DjSC4NuSrVaiu45Ut8KlPItD/BwQaoVjSGV97Y8giz3VvznF1SbjxVouG7IN8iaZNHHS0gwnnhzJ8KZj46pIw0AAn/jpXKutY1P9OcojAdtHi0dNF4l6CXjyrOMQlaKmnkV4ZrOEk7M/A2y1yY8UrIBwqV3lWvuMSohShw5t4deskmJg4mflN8Lpgj2ah75WfMBFN+12BDyNbUJATGse5dnGNAyKMsvervmKnYzAjO2Ri+uXtSJTQ0DxeKtFtw3Cjox+FydAxlwRyVGbGSl7s7gIaGKKYl5wQXQJaFwzsEvBWssNVTFamy9H5YU5nYYrBXcj6Y9kuuOBv/LMH1gmVqL81ujSZtxrg5nQrPn427J7TFyu3gM0NqQdHlZsafFp0ZUDEokY+HZSRO8a5AO1fZWirkcxbe5DUWMTMVm0KJ/pQ95VbIxFk0V5uDV4YTEvn0VQfnNduYdc6Pe+vSYOaHbpWchugazDLW66ZpL3W/R9/G0ELBoJmEmQ1qpTXa+i/bjkjigfsYUSpm0g7nzRBXk+dbbUy0gkyQNtozABZF3wTeFPN4uD8nLIZlzIDp1bEjsFYiV0iixzyW1wfz+rCcRrfBFQMijnQSxm7QrAttwC/MCdMLnbL3/QQspqx5wuRs24lfrp+26BBfv82GGTqsRHxU5/5nfY3w0ccsCE2l6hlsL26/pNg/1MWTm4+0CYInjAZKWF19lYdFQzLE3JWzUQCmlZEvjvWNhC3uxnVs+cRrZEnmW90/Ldg8VZ4jrFJ2+IF6UNJVHgD9vmJJ0XWpki8Qj81oFa3Bj0gMhwiH/uVeCKErO9svH7Q6vcFg1sENh2puidMdMfApiCqR536kcwai5gA9ImhlaZLkmfpSf2TaluhoCrMCcmYRVCeflevxpKSQAqQYxUjWq/rA6PwbjrXYMP8ZPh3k1d2tNDIq34AeOJs5x2uR5HECBP0e+E6eRhtzAPurAlDQg3Xebw/r8Fd+LS/xm7aMRyBY6xO6r9X9kqMUqsFPYubGDkDHI6iU7dH/PdviDyLQ6i4zEcxBwpmQGbUjRAbQvEWB6GvmQo8u5jimoE/yUpzNonIeMbNnw6LlbZ2d0BnhvKfWChew8rLBHyRocZK5C6AEwuqrs3yXNYfaZnwOm+nbxkQPjH5rVymZBF7jsccJ1YZWotjuNy1stIzh/zu0QR1ps2Yy5I2rNnC+PQMNRoQgg/gc4ajyXxG4hsc+0+6y4PsSLkA9MpHBf2+w1/cK6Y0OIlxBpV4K7H7ZrO/r5nAgHN1n7tTvOADcNXSFz4F0HZQp/Td3e+yOvAPFZu8t076FTWYcchmkBbRmaDEZYFEa0MHBYxVaAey4/14xH5aWilOUggiZtVpYUPN79DX0MXctvbY/xTsvWXZx9uPOOPVfXf74mt8Z5Dsx3zLLYzLbkd6+WIzQ3IJOh/4hp9SL1N3Y50VRQkg52oCxSdwGKpPDzxPpi6G0lXBZW7BzG4JAr7rFWC8M3V0MY7aOGNepHKsAI0ypBKQLA2xRihwq+qxxHU4DNAeurW/z6kP0nja55YlFQZF0csw46f6aNKlGxIwZVeQgzx1uNWn2g9b2fIUHNs8YuU6NMHDKDXVefXvXDONVwhmMgowvNKXhj2aTBOMJce/5uL86vHDrCoZVZx+L08liRN6ePCvN8BNkpgqT8ydnRxxWLQtYZQSWKymUJ8B6MJh3fPs+TMj5rPMxQ0Du5VXYxBsm90HnSb3b5ngDSoTKhkcT83RPBrA5z1KFf7KpA1JYp0CnmnYD58jlL2HccOXiyQSPGmwJiepHm/yDu4tcALpFDA9f6HjzpZnsV0hg6DHLT263vZbF/DB+8=

</xenc:CipherValue>

</xenc:CipherData>

</xenc:EncryptedData>

<xenc:EncryptedKey xmlns:xenc="http://www.w3.org/2001/04/xmlenc#"

Id="_9b07dd8a259d8ee8162adf17cd761d34">

<xenc:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-1_5"

xmlns:xenc="http://www.w3.org/2001/04/xmlenc#" />

<ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">

<ds:X509Data>

<ds:X509Certificate>MIIC4DCCAcigAwIBAgIEUUrqgDANBgkqhkiG9w0BAQUFADAyMTAwLgYDVQQDEydCRFNQVUtMNzAz

NDIzODUuY2xpZW50LmJhcmNsYXlzY29ycC5jb20wHhcNMTMwMzIxMTEwOTUyWhcNMTQwMzIxMTEw

OTUyWjAyMTAwLgYDVQQDEydCRFNQVUtMNzAzNDIzODUuY2xpZW50LmJhcmNsYXlzY29ycC5jb20w

ggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCmWG7p7iATCM06WMsKg8LlLg8AXUvyZI6l

hZkz7Sc/moL6WtSUBrL60joLAi4L+P/VrbtZMNzP9kh3uyW0uZ0Vb+DhsXMQBccgdQMzq//nK2GN

0+/F4KYKLsdYpecR28YlOQRl2Y6Gc3i8PZIk2a8bmf64tbOCyOWHzX7fNHo+MSM3JcWOLltFKZCT

z8O8OJjhFqxA7fl+zLBEXprJZtxU/AOaLW6qBPh8w1LmIfU8nK5bnjlKpdobV8uXlXkKVOJWxm1P

yjQDt1G1FKyBKLmyPbw9xY5DSDmQFpwgeZIQdOkRrrYzwYzYFCuqL9USjPw6414kYqBNr221SWei

pLjbAgMBAAEwDQYJKoZIhvcNAQEFBQADggEBAILQ69plSMdO8/3nx5ZJPMWSS2MqFlThAoMW0kmK

20DBH5o3b+6BZ4d566IEGRReOOFVxMKNbuq3thrIliUQG0Qzzu0T41UE7noFXwZOwavYxhy1BdwW

B906CAb0Qq7qu1FXd8PVKzLn7IazaPXSuRkhGmoE4vcRVphRZkzU6xjkfEZ5AO+7qVE/5tcREXAB

coxpqWeTVeZiT0oazx7eWyqVlqSaLboOqByk5O921hY4E7PZaS7HGBXHcywVHU9fXwbEIgNl0noC

sduXcYkjC6WEiV8rQiuBXx5bspPkau28V+GQ1kNwuq5ypEskDW3GHUrZiAmaucooahVzvhDiBM0=

</ds:X509Certificate>

</ds:X509Data>

</ds:KeyInfo>

<xenc:CipherData xmlns:xenc="http://www.w3.org/2001/04/xmlenc#">

<xenc:CipherValue>LhIn8/SjXbnCsMP6ITxb++0rFYpN8S0L6K/VE74XKjh4Jtlo8IaZQi6c9HRqlII/VT5OKaVySNCO2wOaKS/EUsTt5a/0oR9Yh9mCLt9NQDpkxau1OiydwTYoo6G29fFpYgeDXEPrdR4iUlOERuulmFlNTETWu/doHb4b6hFZdsLEtQH1qSi/jBIq2Q7peXI396G8RWDoWO1urJtIQWR5HjqDckcp3eQ2AC3mXkm949g+OS3Y3g/dPi5erkAhNmFXdinOnX6SQWHEBhFkroFfzqkzEPOVlJdL5Rb9X1mgEk5tJefSUChs6HguRqMeMr0s4UFi/KUwlZbINio1hSNTZg==

</xenc:CipherValue>

</xenc:CipherData>

<xenc:ReferenceList>

<xenc:DataReference URI="#_a04f85fb05fda175a5e7eba026640f16" />

</xenc:ReferenceList>

</xenc:EncryptedKey>

</saml2:EncryptedAssertion>

</saml2p:Response>

However, a colleague from another team has informed us that it is possible
to hide the X509 certificate from a SAML token and replace the X509
certificate information with a "KeyName". Is it possible to configure the
opensaml implementation to make this happen? I have worked out how to add
the KeyName field to the token, but not how to do this and remove the X509
certificate.

Thanks in advance for the help.

Kind regards,
Ben Green
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/dev/attachments/20130606/2faa82f0/attachment-0001.html 