Problem with OpenSAML decoding certificate

Tue Jun 18 17:59:03 EDT 2013

Yeah, it's was from Maven central. This is the exact jar our ivy build pulled: http://repo1.maven.org/maven2/ca/juliusdavies/not-yet-commons-ssl/0.3.9/not-yet-commons-ssl-0.3.9.jar

BTW is there a reason why Maven central doesn't have latest versions of OpenSAML? 

On Jun 18, 2013, at 2:37 PM, Brent Putman <putmanb at georgetown.edu> wrote:

> Hmmm... I don't have any recollection of us patching
> not-yet-commons-ssl.  And if we did, we probably would have given it a
> different version string, with something in it to indicate that in
> wasn't the standard version.  I'll do some research.  I'd be interested
> to know whether the jar we have in our (Shib project's) Maven repo and
> shipped in our distribution differs from what is in Maven central
> (assuming that's the repo to which you are referring).
> 
> 
> On 6/18/13 4:03 PM, Mika Koivisto wrote:
>> Answering myself and for anyone else that may run into this issue. I was using not-yet-commons-ssl from maven repository when I switched it to the version bundled with opensaml the exception went away. Version number on both jars is the same so maybe the opensaml one is patched for this issue. 
>> 
>> On Jun 18, 2013, at 9:26 AM, Mika Koivisto <mika.koivisto at liferay.com> wrote:
>> 
>>> Recently I started getting problems with OpenSAML decoding my SAML messages. It has been working just fine and suddenly it complains about not being able to decode a certificate. I'm using OpenSAML 2.5.2 and upgraded to 2.6.0 to see if it would fix the problem but no such luck. 
>>> 
>>> I have no idea what could be wrong all of the sudden. I even wrote a unit test to decode the cert and it fails with the same exception. I verified in debugger that X509Util.decodeCertificate() does receive the BASE64 decoded bytes of the cert in X509Data X509Certificate. Any help would be greatly appreciated. For this response it uses HTTP-POST binding.
>>> 
>>> The stacktrace:
>>> 
>>> Caused by: org.opensaml.ws.security.SecurityPolicyException: Error during trust engine evaluation of the token
>>> 	at org.opensaml.ws.security.provider.BaseTrustEngineRule.evaluate(BaseTrustEngineRule.java:107)
>>> 	at org.opensaml.ws.security.provider.BaseTrustEngineRule.evaluate(BaseTrustEngineRule.java:91)
>>> 	at org.opensaml.common.binding.security.SAMLProtocolMessageXMLSignatureSecurityPolicyRule.doEvaluate(SAMLProtocolMessageXMLSignatureSecurityPolicyRule.java:128)
>>> 	at org.opensaml.common.binding.security.SAMLProtocolMessageXMLSignatureSecurityPolicyRule.evaluate(SAMLProtocolMessageXMLSignatureSecurityPolicyRule.java:107)
>>> 	at org.opensaml.ws.security.provider.BasicSecurityPolicy.evaluate(BasicSecurityPolicy.java:51)
>>> 	at org.opensaml.ws.message.decoder.BaseMessageDecoder.processSecurityPolicy(BaseMessageDecoder.java:132)
>>> 	at org.opensaml.ws.message.decoder.BaseMessageDecoder.decode(BaseMessageDecoder.java:83)
>>> 	at org.opensaml.saml2.binding.decoding.BaseSAML2MessageDecoder.decode(BaseSAML2MessageDecoder.java:70)
>>> 	at com.liferay.saml.profile.BaseProfile.decodeSamlMessage(BaseProfile.java:80)
>>> 	at com.liferay.saml.profile.WebSsoProfileImpl.doProcessResponse(WebSsoProfileImpl.java:410)
>>> 	at com.liferay.saml.profile.WebSsoProfileImpl.processResponse(WebSsoProfileImpl.java:144)
>>> 	... 94 more
>>> Caused by: org.opensaml.xml.security.SecurityException: Error extracting certificates from X509Data
>>> 	at org.opensaml.xml.security.keyinfo.provider.InlineX509DataProvider.extractCertificates(InlineX509DataProvider.java:195)
>>> 	at org.opensaml.xml.security.keyinfo.provider.InlineX509DataProvider.process(InlineX509DataProvider.java:126)
>>> 	at org.opensaml.xml.security.keyinfo.BasicProviderKeyInfoCredentialResolver.processKeyInfoChild(BasicProviderKeyInfoCredentialResolver.java:300)
>>> 	at org.opensaml.xml.security.keyinfo.BasicProviderKeyInfoCredentialResolver.processKeyInfoChildren(BasicProviderKeyInfoCredentialResolver.java:256)
>>> 	at org.opensaml.xml.security.keyinfo.BasicProviderKeyInfoCredentialResolver.processKeyInfo(BasicProviderKeyInfoCredentialResolver.java:190)
>>> 	at org.opensaml.xml.security.keyinfo.BasicProviderKeyInfoCredentialResolver.resolveFromSource(BasicProviderKeyInfoCredentialResolver.java:149)
>>> 	at org.opensaml.xml.security.credential.AbstractCriteriaFilteringCredentialResolver.resolve(AbstractCriteriaFilteringCredentialResolver.java:57)
>>> 	at org.opensaml.xml.security.credential.AbstractCriteriaFilteringCredentialResolver.resolve(AbstractCriteriaFilteringCredentialResolver.java:37)
>>> 	at org.opensaml.security.MetadataCredentialResolver.retrieveFromMetadata(MetadataCredentialResolver.java:275)
>>> 	at org.opensaml.security.MetadataCredentialResolver.resolveFromSource(MetadataCredentialResolver.java:178)
>>> 	at org.opensaml.xml.security.credential.AbstractCriteriaFilteringCredentialResolver.resolve(AbstractCriteriaFilteringCredentialResolver.java:57)
>>> 	at org.opensaml.xml.security.credential.AbstractCriteriaFilteringCredentialResolver.resolve(AbstractCriteriaFilteringCredentialResolver.java:37)
>>> 	at org.opensaml.xml.signature.impl.ExplicitKeySignatureTrustEngine.validate(ExplicitKeySignatureTrustEngine.java:98)
>>> 	at org.opensaml.xml.signature.impl.ExplicitKeySignatureTrustEngine.validate(ExplicitKeySignatureTrustEngine.java:49)
>>> 	at org.opensaml.xml.signature.impl.ChainingSignatureTrustEngine.validate(ChainingSignatureTrustEngine.java:68)
>>> 	at org.opensaml.xml.signature.impl.ChainingSignatureTrustEngine.validate(ChainingSignatureTrustEngine.java:37)
>>> 	at org.opensaml.ws.security.provider.BaseTrustEngineRule.evaluate(BaseTrustEngineRule.java:104)
>>> 	... 104 more
>>> Caused by: java.security.cert.CertificateException: Unable to decode X.509 certificates
>>> 	at org.opensaml.xml.security.x509.X509Util.decodeCertificate(X509Util.java:354)
>>> 	at org.opensaml.xml.security.keyinfo.KeyInfoHelper.getCertificate(KeyInfoHelper.java:201)
>>> 	at org.opensaml.xml.security.keyinfo.KeyInfoHelper.getCertificates(KeyInfoHelper.java:176)
>>> 	at org.opensaml.xml.security.keyinfo.provider.InlineX509DataProvider.extractCertificates(InlineX509DataProvider.java:192)
>>> 	... 120 more
>>> Caused by: java.security.KeyStoreException: failed to extract any certificates or private keys - maybe bad password?
>>> 	at org.apache.commons.ssl.KeyStoreBuilder.parse(KeyStoreBuilder.java:443)
>>> 	at org.apache.commons.ssl.TrustMaterial.<init>(TrustMaterial.java:213)
>>> 	at org.apache.commons.ssl.TrustMaterial.<init>(TrustMaterial.java:165)
>>> 	at org.opensaml.xml.security.x509.X509Util.decodeCertificate(X509Util.java:351)
>>> 	... 123 more
>>> 
>>> 
>>> Here's the unit test I used to get the exact same exception as above: https://gist.github.com/mikakoivisto/888d7d83e1747d2e96b0#file-certificatetest-java
>>> 
>>> Here's a inbound SAML Response that fails with the exception above: https://gist.github.com/mikakoivisto/888d7d83e1747d2e96b0#file-saml-response-xml
>>> 
>>> Here's the metadata of my IDP: https://gist.github.com/mikakoivisto/888d7d83e1747d2e96b0#file-idp-metadata-xml
>>> 
>>> SP metadata: https://gist.github.com/mikakoivisto/888d7d83e1747d2e96b0#file-sp-metadata-xml
>>> 
>> --
>> To unsubscribe from this list send an email to dev-unsubscribe at shibboleth.net
> 
> --
> To unsubscribe from this list send an email to dev-unsubscribe at shibboleth.net