OpenSAML - Working with CDATA in attribute values and encrypting Assertions

[Keerthi Kumar]

Hello All,

I am trying to work with CDATA and encryption in SAML 2.0 assertion and
have run into an issue. Would really appreciate if somebody can help me.

Issue -

I am trying to create a SAML assertion with CDATA in the attribute value
(Example : <saml2:Attribute
Name="someAttribute"><saml2:AttributeValue><![CDATA[<?xml version="1.0"
encoding="UTF-8" ?><a>xyz</a>]]></saml2:AttributeValue></saml2:Attribute>)

I tried various ways to create such an attribute, but found that the CDATA
was being escaped (>&lt;![CDATA[&lt;?xml version="1.0" encoding="UTF-8"
?&gt; ..).

I could make CDATA not be escaped by OpenSAML when I created the attribute
value like below -

XMLObjectBuilder builder = getSAMLBuilder().getBuilder(XSAny.TYPE_NAME);

XSAny attrValue = (XSAny)
builder.buildObject(AttributeValue.DEFAULT_ELEMENT_NAME, XSAny.TYPE_NAME);

Document doc = createEmptyDocument();
CDATASection cdataSection = doc.createCDATASection(cdataValue);

Element e = doc.createElement("saml2:AttributeValue");
//e.setAttribute("xmlns:xsi", "http://www.w3.org/2001/XMLSchema-instance");
//e.setAttribute("xsi:type", "xs:cdata");
doc.appendChild(e);
e.appendChild(cdataSection);
attrValue.setDOM(e);
attr.getAttributeValues().add(attrValue)

So, although the assertion with the attribute value above will have
unescaped, correct attribute value, when I encrypt an assertion with this
attribute value and decrypt the assertion, I find that the attribute value
is escaped.

Does anybody know how to make this work? Am I setting the CDATA correctly?
And can CDATA work with encrypting the assertion? Or should I make any
changes to the encrypter so that the decrypted assertion has the correct
attribute value?

Thanks!
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/dev/attachments/20141024/eaf2e5fb/attachment.html