Problem with OpenSAML decoding certificate

[Mika Koivisto]

Recently I started getting problems with OpenSAML decoding my SAML messages. It has been working just fine and suddenly it complains about not being able to decode a certificate. I'm using OpenSAML 2.5.2 and upgraded to 2.6.0 to see if it would fix the problem but no such luck. 

I have no idea what could be wrong all of the sudden. I even wrote a unit test to decode the cert and it fails with the same exception. I verified in debugger that X509Util.decodeCertificate() does receive the BASE64 decoded bytes of the cert in X509Data X509Certificate. Any help would be greatly appreciated. For this response it uses HTTP-POST binding.

The stacktrace:

Caused by: org.opensaml.ws.security.SecurityPolicyException: Error during trust engine evaluation of the token
	at org.opensaml.ws.security.provider.BaseTrustEngineRule.evaluate(BaseTrustEngineRule.java:107)
	at org.opensaml.ws.security.provider.BaseTrustEngineRule.evaluate(BaseTrustEngineRule.java:91)
	at org.opensaml.common.binding.security.SAMLProtocolMessageXMLSignatureSecurityPolicyRule.doEvaluate(SAMLProtocolMessageXMLSignatureSecurityPolicyRule.java:128)
	at org.opensaml.common.binding.security.SAMLProtocolMessageXMLSignatureSecurityPolicyRule.evaluate(SAMLProtocolMessageXMLSignatureSecurityPolicyRule.java:107)
	at org.opensaml.ws.security.provider.BasicSecurityPolicy.evaluate(BasicSecurityPolicy.java:51)
	at org.opensaml.ws.message.decoder.BaseMessageDecoder.processSecurityPolicy(BaseMessageDecoder.java:132)
	at org.opensaml.ws.message.decoder.BaseMessageDecoder.decode(BaseMessageDecoder.java:83)
	at org.opensaml.saml2.binding.decoding.BaseSAML2MessageDecoder.decode(BaseSAML2MessageDecoder.java:70)
	at com.liferay.saml.profile.BaseProfile.decodeSamlMessage(BaseProfile.java:80)
	at com.liferay.saml.profile.WebSsoProfileImpl.doProcessResponse(WebSsoProfileImpl.java:410)
	at com.liferay.saml.profile.WebSsoProfileImpl.processResponse(WebSsoProfileImpl.java:144)
	... 94 more
Caused by: org.opensaml.xml.security.SecurityException: Error extracting certificates from X509Data
	at org.opensaml.xml.security.keyinfo.provider.InlineX509DataProvider.extractCertificates(InlineX509DataProvider.java:195)
	at org.opensaml.xml.security.keyinfo.provider.InlineX509DataProvider.process(InlineX509DataProvider.java:126)
	at org.opensaml.xml.security.keyinfo.BasicProviderKeyInfoCredentialResolver.processKeyInfoChild(BasicProviderKeyInfoCredentialResolver.java:300)
	at org.opensaml.xml.security.keyinfo.BasicProviderKeyInfoCredentialResolver.processKeyInfoChildren(BasicProviderKeyInfoCredentialResolver.java:256)
	at org.opensaml.xml.security.keyinfo.BasicProviderKeyInfoCredentialResolver.processKeyInfo(BasicProviderKeyInfoCredentialResolver.java:190)
	at org.opensaml.xml.security.keyinfo.BasicProviderKeyInfoCredentialResolver.resolveFromSource(BasicProviderKeyInfoCredentialResolver.java:149)
	at org.opensaml.xml.security.credential.AbstractCriteriaFilteringCredentialResolver.resolve(AbstractCriteriaFilteringCredentialResolver.java:57)
	at org.opensaml.xml.security.credential.AbstractCriteriaFilteringCredentialResolver.resolve(AbstractCriteriaFilteringCredentialResolver.java:37)
	at org.opensaml.security.MetadataCredentialResolver.retrieveFromMetadata(MetadataCredentialResolver.java:275)
	at org.opensaml.security.MetadataCredentialResolver.resolveFromSource(MetadataCredentialResolver.java:178)
	at org.opensaml.xml.security.credential.AbstractCriteriaFilteringCredentialResolver.resolve(AbstractCriteriaFilteringCredentialResolver.java:57)
	at org.opensaml.xml.security.credential.AbstractCriteriaFilteringCredentialResolver.resolve(AbstractCriteriaFilteringCredentialResolver.java:37)
	at org.opensaml.xml.signature.impl.ExplicitKeySignatureTrustEngine.validate(ExplicitKeySignatureTrustEngine.java:98)
	at org.opensaml.xml.signature.impl.ExplicitKeySignatureTrustEngine.validate(ExplicitKeySignatureTrustEngine.java:49)
	at org.opensaml.xml.signature.impl.ChainingSignatureTrustEngine.validate(ChainingSignatureTrustEngine.java:68)
	at org.opensaml.xml.signature.impl.ChainingSignatureTrustEngine.validate(ChainingSignatureTrustEngine.java:37)
	at org.opensaml.ws.security.provider.BaseTrustEngineRule.evaluate(BaseTrustEngineRule.java:104)
	... 104 more
Caused by: java.security.cert.CertificateException: Unable to decode X.509 certificates
	at org.opensaml.xml.security.x509.X509Util.decodeCertificate(X509Util.java:354)
	at org.opensaml.xml.security.keyinfo.KeyInfoHelper.getCertificate(KeyInfoHelper.java:201)
	at org.opensaml.xml.security.keyinfo.KeyInfoHelper.getCertificates(KeyInfoHelper.java:176)
	at org.opensaml.xml.security.keyinfo.provider.InlineX509DataProvider.extractCertificates(InlineX509DataProvider.java:192)
	... 120 more
Caused by: java.security.KeyStoreException: failed to extract any certificates or private keys - maybe bad password?
	at org.apache.commons.ssl.KeyStoreBuilder.parse(KeyStoreBuilder.java:443)
	at org.apache.commons.ssl.TrustMaterial.<init>(TrustMaterial.java:213)
	at org.apache.commons.ssl.TrustMaterial.<init>(TrustMaterial.java:165)
	at org.opensaml.xml.security.x509.X509Util.decodeCertificate(X509Util.java:351)
	... 123 more


Here's the unit test I used to get the exact same exception as above: https://gist.github.com/mikakoivisto/888d7d83e1747d2e96b0#file-certificatetest-java

Here's a inbound SAML Response that fails with the exception above: https://gist.github.com/mikakoivisto/888d7d83e1747d2e96b0#file-saml-response-xml

Here's the metadata of my IDP: https://gist.github.com/mikakoivisto/888d7d83e1747d2e96b0#file-idp-metadata-xml

SP metadata: https://gist.github.com/mikakoivisto/888d7d83e1747d2e96b0#file-sp-metadata-xml