Key resolver in Decryptor

[Sandy]

Hi,

I am using OpenSaml library and xmltooling library for implementing our SP.
I have message decryption working fine when using Shibboleth IdP. When we
tried a different IdP, the decryption failed. After digging in, I
understood that it fails because it was not able to resolve a `Credential`
for decrypting the <EncryptedKey> element.

In case of Shibboleth IdP's response, the <EcryptedKey> element contains
the <ds:KeyInfo> element as a child that contains the <X509Certificate>
that helps resolve a credential from `LocalKeyInfoCredentialResolver`. In
short, this is the exact case from the complex example for Decryption
listed in the OSTwoUser manual here
<https://wiki.shibboleth.net/confluence/display/OpenSAML/OSTwoUserManJavaXMLEncryption>
.

In case of the third party IdP's response, the <EncryptedKey> element does
not contain the <ds:KeyInfo> element as a child(but the <X509Data> element
with <X509Certificate> is present as a peer element of <EcryptedKey>).
Decryption fails in this case as it was not able to resolve a the
credential from the supplied LocalKeyInfoCredentialResolver.

However, when I use a StaticKeyInfoCredentialResolver(SKICR) in case of
LocalKeyInfoCredentialResolver(LKICR), the decryption succeeds. Is there a
way for the Decrypter to try both, i.e. try to resolve using LKICR, and if
it fails, try SKICR?

Sorry for the long post, but I thought that something along the lines of
ChainingKeyInfoCredentialResolver should exist, but as it does not, either
the above case is invalid and I'm missing something or there is some other
way to achieve this.

Thank you,
-Sundeep
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/dev/attachments/20150226/f1c42f7a/attachment-0001.html