Problem with OpenSAML decoding certificate

[Brent Putman]

Hmmm... I don't have any recollection of us patching
not-yet-commons-ssl.  And if we did, we probably would have given it a
different version string, with something in it to indicate that in
wasn't the standard version.  I'll do some research.  I'd be interested
to know whether the jar we have in our (Shib project's) Maven repo and
shipped in our distribution differs from what is in Maven central
(assuming that's the repo to which you are referring).


On 6/18/13 4:03 PM, Mika Koivisto wrote:
> Answering myself and for anyone else that may run into this issue. I was using not-yet-commons-ssl from maven repository when I switched it to the version bundled with opensaml the exception went away. Version number on both jars is the same so maybe the opensaml one is patched for this issue. 
>
> On Jun 18, 2013, at 9:26 AM, Mika Koivisto <mika.koivisto at liferay.com> wrote:
>
>> Recently I started getting problems with OpenSAML decoding my SAML messages. It has been working just fine and suddenly it complains about not being able to decode a certificate. I'm using OpenSAML 2.5.2 and upgraded to 2.6.0 to see if it would fix the problem but no such luck. 
>>
>> I have no idea what could be wrong all of the sudden. I even wrote a unit test to decode the cert and it fails with the same exception. I verified in debugger that X509Util.decodeCertificate() does receive the BASE64 decoded bytes of the cert in X509Data X509Certificate. Any help would be greatly appreciated. For this response it uses HTTP-POST binding.
>>
>> The stacktrace:
>>
>> Caused by: org.opensaml.ws.security.SecurityPolicyException: Error during trust engine evaluation of the token
>> 	at org.opensaml.ws.security.provider.BaseTrustEngineRule.evaluate(BaseTrustEngineRule.java:107)
>> 	at org.opensaml.ws.security.provider.BaseTrustEngineRule.evaluate(BaseTrustEngineRule.java:91)
>> 	at org.opensaml.common.binding.security.SAMLProtocolMessageXMLSignatureSecurityPolicyRule.doEvaluate(SAMLProtocolMessageXMLSignatureSecurityPolicyRule.java:128)
>> 	at org.opensaml.common.binding.security.SAMLProtocolMessageXMLSignatureSecurityPolicyRule.evaluate(SAMLProtocolMessageXMLSignatureSecurityPolicyRule.java:107)
>> 	at org.opensaml.ws.security.provider.BasicSecurityPolicy.evaluate(BasicSecurityPolicy.java:51)
>> 	at org.opensaml.ws.message.decoder.BaseMessageDecoder.processSecurityPolicy(BaseMessageDecoder.java:132)
>> 	at org.opensaml.ws.message.decoder.BaseMessageDecoder.decode(BaseMessageDecoder.java:83)
>> 	at org.opensaml.saml2.binding.decoding.BaseSAML2MessageDecoder.decode(BaseSAML2MessageDecoder.java:70)
>> 	at com.liferay.saml.profile.BaseProfile.decodeSamlMessage(BaseProfile.java:80)
>> 	at com.liferay.saml.profile.WebSsoProfileImpl.doProcessResponse(WebSsoProfileImpl.java:410)
>> 	at com.liferay.saml.profile.WebSsoProfileImpl.processResponse(WebSsoProfileImpl.java:144)
>> 	... 94 more
>> Caused by: org.opensaml.xml.security.SecurityException: Error extracting certificates from X509Data
>> 	at org.opensaml.xml.security.keyinfo.provider.InlineX509DataProvider.extractCertificates(InlineX509DataProvider.java:195)
>> 	at org.opensaml.xml.security.keyinfo.provider.InlineX509DataProvider.process(InlineX509DataProvider.java:126)
>> 	at org.opensaml.xml.security.keyinfo.BasicProviderKeyInfoCredentialResolver.processKeyInfoChild(BasicProviderKeyInfoCredentialResolver.java:300)
>> 	at org.opensaml.xml.security.keyinfo.BasicProviderKeyInfoCredentialResolver.processKeyInfoChildren(BasicProviderKeyInfoCredentialResolver.java:256)
>> 	at org.opensaml.xml.security.keyinfo.BasicProviderKeyInfoCredentialResolver.processKeyInfo(BasicProviderKeyInfoCredentialResolver.java:190)
>> 	at org.opensaml.xml.security.keyinfo.BasicProviderKeyInfoCredentialResolver.resolveFromSource(BasicProviderKeyInfoCredentialResolver.java:149)
>> 	at org.opensaml.xml.security.credential.AbstractCriteriaFilteringCredentialResolver.resolve(AbstractCriteriaFilteringCredentialResolver.java:57)
>> 	at org.opensaml.xml.security.credential.AbstractCriteriaFilteringCredentialResolver.resolve(AbstractCriteriaFilteringCredentialResolver.java:37)
>> 	at org.opensaml.security.MetadataCredentialResolver.retrieveFromMetadata(MetadataCredentialResolver.java:275)
>> 	at org.opensaml.security.MetadataCredentialResolver.resolveFromSource(MetadataCredentialResolver.java:178)
>> 	at org.opensaml.xml.security.credential.AbstractCriteriaFilteringCredentialResolver.resolve(AbstractCriteriaFilteringCredentialResolver.java:57)
>> 	at org.opensaml.xml.security.credential.AbstractCriteriaFilteringCredentialResolver.resolve(AbstractCriteriaFilteringCredentialResolver.java:37)
>> 	at org.opensaml.xml.signature.impl.ExplicitKeySignatureTrustEngine.validate(ExplicitKeySignatureTrustEngine.java:98)
>> 	at org.opensaml.xml.signature.impl.ExplicitKeySignatureTrustEngine.validate(ExplicitKeySignatureTrustEngine.java:49)
>> 	at org.opensaml.xml.signature.impl.ChainingSignatureTrustEngine.validate(ChainingSignatureTrustEngine.java:68)
>> 	at org.opensaml.xml.signature.impl.ChainingSignatureTrustEngine.validate(ChainingSignatureTrustEngine.java:37)
>> 	at org.opensaml.ws.security.provider.BaseTrustEngineRule.evaluate(BaseTrustEngineRule.java:104)
>> 	... 104 more
>> Caused by: java.security.cert.CertificateException: Unable to decode X.509 certificates
>> 	at org.opensaml.xml.security.x509.X509Util.decodeCertificate(X509Util.java:354)
>> 	at org.opensaml.xml.security.keyinfo.KeyInfoHelper.getCertificate(KeyInfoHelper.java:201)
>> 	at org.opensaml.xml.security.keyinfo.KeyInfoHelper.getCertificates(KeyInfoHelper.java:176)
>> 	at org.opensaml.xml.security.keyinfo.provider.InlineX509DataProvider.extractCertificates(InlineX509DataProvider.java:192)
>> 	... 120 more
>> Caused by: java.security.KeyStoreException: failed to extract any certificates or private keys - maybe bad password?
>> 	at org.apache.commons.ssl.KeyStoreBuilder.parse(KeyStoreBuilder.java:443)
>> 	at org.apache.commons.ssl.TrustMaterial.<init>(TrustMaterial.java:213)
>> 	at org.apache.commons.ssl.TrustMaterial.<init>(TrustMaterial.java:165)
>> 	at org.opensaml.xml.security.x509.X509Util.decodeCertificate(X509Util.java:351)
>> 	... 123 more
>>
>>
>> Here's the unit test I used to get the exact same exception as above: https://gist.github.com/mikakoivisto/888d7d83e1747d2e96b0#file-certificatetest-java
>>
>> Here's a inbound SAML Response that fails with the exception above: https://gist.github.com/mikakoivisto/888d7d83e1747d2e96b0#file-saml-response-xml
>>
>> Here's the metadata of my IDP: https://gist.github.com/mikakoivisto/888d7d83e1747d2e96b0#file-idp-metadata-xml
>>
>> SP metadata: https://gist.github.com/mikakoivisto/888d7d83e1747d2e96b0#file-sp-metadata-xml
>>
> --
> To unsubscribe from this list send an email to dev-unsubscribe at shibboleth.net