Help with assertion encryption ?

[Tom Zeller]

> Yeah, I'm 99.99% sure you either have:
>
> 1) SP metadata with a KeyDescriptor/EncryptionMethod that indicates these
> algorithms.
> 2) Explict EncryptionConfiguration somewhere that specifies these
>
> This is what the logs shows as being resolved.  Note it's also getting RSA
> OAEP 1.1:
>
> 2014-05-19 23:16:05.107 [DEBUG] :
> org.opensaml.xmlsec.impl.BasicEncryptionParametersResolver: Resolved
> EncryptionParameters:
> 2014-05-19 23:16:05.107 [DEBUG] :
> org.opensaml.xmlsec.impl.BasicEncryptionParametersResolver:     Key
> transport credential with key algorithm: RSA
> 2014-05-19 23:16:05.107 [DEBUG] :
> org.opensaml.xmlsec.impl.BasicEncryptionParametersResolver:     Key
> transport algorithm URI: http://www.w3.org/2009/xmlenc11#rsa-oaep
> 2014-05-19 23:16:05.107 [DEBUG] :
> org.opensaml.xmlsec.impl.BasicEncryptionParametersResolver:     Key
> transport KeyInfoGenerator: present
> 2014-05-19 23:16:05.107 [DEBUG] :
> org.opensaml.xmlsec.impl.BasicEncryptionParametersResolver:     Data
> encryption credential: null
> 2014-05-19 23:16:05.108 [DEBUG] :
> org.opensaml.xmlsec.impl.BasicEncryptionParametersResolver:     Data
> encryption algorithm URI: http://www.w3.org/2009/xmlenc11#aes128-gcm
> 2014-05-19 23:16:05.108 [DEBUG] :
> org.opensaml.xmlsec.impl.BasicEncryptionParametersResolver:     Data
> encryption KeyInfoGenerator: null
>
>
>
> I actually suspected #1, but for that on DEBUG there ought to be a line like
> "Resolved data encryption algorithm URI from SAML metadata EncryptionMethod:
> {}" and I don't see those, so I actually think you must have #2.
>
> Although there's other DEBUG output that I don't see, so maybe the logging
> config isn't DEBUG for all of OpenSAML.  So I'm still a little confused.
>
> It actually logs a bit more on TRACE.

I was using vanilla configs, for which
idp-conf/src/main/resources/conf/logback.xml has for OpenSAML :

<logger name="org.opensaml" level="WARN" />
<logger name="org.opensaml.saml.common.binding" level="DEBUG" />
<logger name="org.opensaml.saml.saml1.binding" level="DEBUG" />
<logger name="org.opensaml.saml.common.profile" level="DEBUG" />
<logger name="org.opensaml.saml.saml1.profile" level="DEBUG" />
<logger name="org.opensaml.saml.saml2.binding" level="DEBUG" />
<logger name="org.opensaml.saml.saml2.profile" level="DEBUG" />
<logger name="org.opensaml.storage" level="TRACE" />
<logger name="org.opensaml.xmlsec" level="DEBUG" />
<logger name="PROTOCOL_MESSAGE" level="DEBUG" />
<root level="warn">

Also, I attached the test SP's metadata to my home page on the wiki.