Bouncy Castle?

[Cantor, Scott]

On 5/14/14, 6:11 PM, "Brent Putman" <putmanb at georgetown.edu> wrote:
>
>No, IIRC in the MCR if it's not passed it effectively uses the
>UNSPECIFIED one, which matches everything.

Yeah, that's the issue I had. What I meant was whether the encryption
resolver would add the usage criterion that limits the lookup to
encryption usage or if I had to do that myself. From what I can tell, I
have to do that, because otherwise it will use UNSPECIFIED, and return
arbitrary keys. That was why it wasn't working.

It's in place now, but it seemed odd to me that I'd have to tell it that,
since it is a SAML-specific resolver calling into a SAML-specific
credential resolver, knowing it's doing encryption related work.

>From the Jenkins stack trace that I did see, it seemed like that wasn't
>involved.

There were a variety of errors due to differences in the results when you
try and decrypt a key with the wrong key, but the underlying problem was
always the same, the wrong key transport key chosen by the IdP code. I
thought at first it was metadata out of sync, but it was the usage
criterion.

Separately, I don't know why I saw that Bouncy Castle stack trace on one
particular failed run, but I definitely did. I don't have a record of it
unfortunately.

-- Scott