Decrypting EncryptedAssertion openSAML-C++

[Akshay Singh]

Hi,



Sorry if this is a re-post but I didnot see this one on the list.

I am writing client side of an authentication service, where I get encrypted and signed SAML response from the server process.
I am confused about the right way to decrypt an encrypted response (precisely, a signed response with encrypted assertion in it). I am writing the pseudo-code which I have (mainly from the saml-2.5.3-src/samltest/encryption/EncryptedAssertionTest.h) : 

========================================

/* get the credential resolver */
credentialresolver* c_resolver = null;
std::string config = keystore_path + "filesystemcredentialresolver.xml";// has client private/public key
std::ifstream in(config.c_str());
domdocument* doc = xmltoolingconfig::getconfig().getparser().parse(in);
xercesjanitor<domdocument> janitor(doc);
c_resolver = xmltoolingconfig::getconfig().credentialresolvermanager.
newplugin(filesystem_credential_resolver,doc->getdocumentelement());
in.close();

/* get the meta-data provider details */
    std::string m_config = keystore_path + "metadataproviderconfig.xml"; // tells the path of actual metadata file
    std::ifstream m_in(m_config.c_str());
    domdocument* m_doc = xmltoolingconfig::getconfig().getparser().parse(m_in);
  xercesjanitor<domdocument> m_janitor(m_doc);
    auto_ptr_xmlch md_path("path");
    std::string s = keystore_path + "metadata.xml";// same file as example-metadata.xml in samltest/data
    auto_ptr_xmlch file(s.c_str());
    (m_doc->getdocumentelement())->setattributens(null, md_path.get(), file.get());
    opensaml::saml2md::metadataprovider *m_metadata =  opensaml::samlconfig::getconfig().metadataprovidermanager.newplugin(
        xml_metadata_provider,m_doc->getdocumentelement());
    m_metadata->init();
    locker mlocker(m_metadata);

    /* create metadata provider */
    opensaml::saml2md::metadataprovider::criteria mc("https://sp.example.org/", &opensaml::saml2md::spssodescriptor::element_qname, samlconstants::saml20p_ns);
    std::pair<const opensaml::saml2md::entitydescriptor*,const opensaml::saml2md::roledescriptor*> sp = 
m_metadata->getentitydescriptor(mc);

    /* get encrypted assertion from response (available to this function) */
    encryptedassertion *ea = null;
if ((response->getencryptedassertions()).size() > 0) {
/* get the first encrypted assertion */
 ea = dynamic_cast<encryptedassertion*>((response->getencryptedassertions()).at(0));
  }
std::auto_ptr<opensaml::saml2::assertion> assertion2(dynamic_cast<opensaml::saml2::assertion*>(ea->
decrypt(*c_resolver, sp.first->getentityid())));

=================================

I have posted the same code in pastebin (http://pastebin.com/VvLnDxGv).
Is it the right way to do it or this code is too convoluted for what it is supposed to do (extracting decrypted assertion from encrypted assertion, which is in a SAML response). This code dumps core on the last decrypt step 
ea->decrypt(*c_resolver, sp.first->getentityid())

Please advise.

Thanks,
Akshay
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/dev/attachments/20140422/c8982e56/attachment-0001.html