Help with assertion encryption ?

[Brent Putman]

On 5/20/14 12:57 PM, Tom Zeller wrote:
>> The full stacktrace might be useful, just to tell us where/how it's
>> happening.
> Okay, I attached the log file to my home page on the wiki as
> "2014-05-20-tom-weird-stack-trace.txt".

Yeah, I'm 99.99% sure you either have:

1) SP metadata with a KeyDescriptor/EncryptionMethod that indicates
these algorithms.
2) Explict EncryptionConfiguration somewhere that specifies these

This is what the logs shows as being resolved.  Note it's also getting
RSA OAEP 1.1:

2014-05-19 23:16:05.107 [DEBUG] :
org.opensaml.xmlsec.impl.BasicEncryptionParametersResolver: Resolved
EncryptionParameters:
2014-05-19 23:16:05.107 [DEBUG] :
org.opensaml.xmlsec.impl.BasicEncryptionParametersResolver:     Key
transport credential with key algorithm: RSA
2014-05-19 23:16:05.107 [DEBUG] :
org.opensaml.xmlsec.impl.BasicEncryptionParametersResolver:     Key
transport algorithm URI: http://www.w3.org/2009/xmlenc11#rsa-oaep
2014-05-19 23:16:05.107 [DEBUG] :
org.opensaml.xmlsec.impl.BasicEncryptionParametersResolver:     Key
transport KeyInfoGenerator: present
2014-05-19 23:16:05.107 [DEBUG] :
org.opensaml.xmlsec.impl.BasicEncryptionParametersResolver:     Data
encryption credential: null
2014-05-19 23:16:05.108 [DEBUG] :
org.opensaml.xmlsec.impl.BasicEncryptionParametersResolver:     Data
encryption algorithm URI: http://www.w3.org/2009/xmlenc11#aes128-gcm
2014-05-19 23:16:05.108 [DEBUG] :
org.opensaml.xmlsec.impl.BasicEncryptionParametersResolver:     Data
encryption KeyInfoGenerator: null



I actually suspected #1, but for that on DEBUG there ought to be a line
like "Resolved data encryption algorithm URI from SAML metadata
EncryptionMethod: {}" and I don't see those, so I actually think you
must have #2.

Although there's other DEBUG output that I don't see, so maybe the
logging config isn't DEBUG for all of OpenSAML.  So I'm still a little
confused.

It actually logs a bit more on TRACE.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/dev/attachments/20140520/5d4751c7/attachment-0001.html