OpenSAML V3: Problems while marshaling encrypted assertion

Wed Apr 26 21:39:14 EDT 2017

Hi Brent, thanks for you reply. First I was using V2 so I followed the book to migrate from V2 to V3.

This is how I am signing the assertion:

    private Assertion createSignedAssertion() throws SamlException {

        try {

            Signature signature = createSignature();

            Assertion assertion = createAssertion();

            assertion.setSignature(signature);

            MarshallerFactory marshallerFactory = XMLObjectProviderRegistrySupport.getMarshallerFactory();

            marshallerFactory.getMarshaller(assertion).marshall(assertion);

            Signer.signObject(signature);

            UnmarshallerFactory unmarshallerFactory = XMLObjectProviderRegistrySupport.getUnmarshallerFactory();

            Assertion signedAssertion = (Assertion) unmarshallerFactory.getUnmarshaller(assertion.getDOM()).unmarshall(assertion.getDOM());

            return signedAssertion;

        } catch (Exception e) {

            throw new SamlException(e);

        }

    }

This is how I am creating my signature

private Signature createSignature() throws SamlException {

if (this.signingCertificate != null && this.signingPrivateKey != null) {

Signature signature = OpenSAMLUtils.buildSAMLObject(Signature.class);

signature.setSigningCredential(new BasicX509Credential((X509Certificate) signingCertificate, signingPrivateKey));

signature.setSignatureAlgorithm(SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA1);

signature.setCanonicalizationAlgorithm(SignatureConstants.ALGO_ID_C14N_WITH_COMMENTS);

return signature;

}

return null;

}

It does work because I am able to print the response with the signed assertion, and this is how I am creating my Response object

private Response createResponse(Assertion assertion, EncryptedAssertion encryptedAssertion) {

Response response = OpenSAMLUtils.buildSAMLObject(Response.class);

response.setID(this.responseId);

response.setIssueInstant(this.issueInstant);

response.setVersion(SAMLVersion.VERSION_20);

response.setIssuer(createIssuer(responseIssuer));

response.setStatus(createStatus());

if(this.responseDestination != null) response.setDestination(this.responseDestination);

if(assertion != null) response.getAssertions().add(assertion);

if(encryptedAssertion != null) response.getEncryptedAssertions().add(encryptedAssertion);

return response;

}

The OpenSAMLUtils.buildSAMLObject is the code provided in the OpenSAML V3 book.

    public static <T> T buildSAMLObject(final Class<T> clazz) {

        T object = null;

        try {

            XMLObjectBuilderFactory builderFactory = XMLObjectProviderRegistrySupport.getBuilderFactory();

            QName defaultElementName = (QName) clazz.getDeclaredField("DEFAULT_ELEMENT_NAME").get(null);

            object = (T) builderFactory.getBuilder(defaultElementName).buildObject(defaultElementName);

        } catch (IllegalAccessException e) {

            throw new IllegalArgumentException("Could not create SAML object");

        } catch (NoSuchFieldException e) {

            throw new IllegalArgumentException("Could not create SAML object");

        }

        return object;

    }

This is my full class: https://hastebin.com/otibeqocap.java

Thank you

From: dev <dev-bounces at shibboleth.net<mailto:dev-bounces at shibboleth.net>> on behalf of Brent Putman <putmanb at georgetown.edu<mailto:putmanb at georgetown.edu>>
Reply-To: Shib Dev <dev at shibboleth.net<mailto:dev at shibboleth.net>>
Date: Wednesday, April 26, 2017 at 7:12 PM
To: "dev at shibboleth.net<mailto:dev at shibboleth.net>" <dev at shibboleth.net<mailto:dev at shibboleth.net>>
Subject: Re: OpenSAML V3: Problems while marshaling encrypted assertion

On 4/26/17 12:47 PM, Locatelli da Silva, Thiago wrote:
By any chance, does anyone know what I am doing wrong?

http://stackoverflow.com/questions/43636869/error-exception-while-marshalling-signed-and-encrypted-response-opensaml-v3<https://urldefense.proofpoint.com/v2/url?u=http-3A__stackoverflow.com_questions_43636869_error-2Dexception-2Dwhile-2Dmarshalling-2Dsigned-2Dand-2Dencrypted-2Dresponse-2Dopensaml-2Dv3&d=DwMD-g&c=9g4MJkl2VjLjS6R4ei18BA&r=KFwt8mjPy_yYOL1zsYKnEeZFUYrLAC8JhxUYm-xzRVnN6LfAFPxkaK1E0ofPGXNB&m=JKRzQCebPibajqPFZUSAtqGoHMK4Xnd_533X0fndqig&s=q2ylKOxKkxJLslUiDhhIAIrg5dXCEZu8VhwY78afg6M&e=>

I can't see anything obviously wrong with what you are doing.  I suspect that the issue might lie with what you are doing *before* the code you posted there, such as when/how you are encrypting the Assertion and then adding the EncryptedAssertion to the Response; how those XMLObjects are all being constructed, and so on.

I can state with certainty that it does in general work, as we do this very thing in the Shibboleth IdP.  In case it's helpful, here is the OpenSAML profile action component which encrypts Assertions and adds them to the Response, which is used in the IdP for this purpose:

https://git.shibboleth.net/view/?p=java-opensaml.git;a=blob;f=opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/profile/impl/EncryptAssertions.java;hb=HEAD<https://urldefense.proofpoint.com/v2/url?u=https-3A__git.shibboleth.net_view_-3Fp-3Djava-2Dopensaml.git-3Ba-3Dblob-3Bf-3Dopensaml-2Dsaml-2Dimpl_src_main_java_org_opensaml_saml_saml2_profile_impl_EncryptAssertions.java-3Bhb-3DHEAD&d=DwMD-g&c=9g4MJkl2VjLjS6R4ei18BA&r=KFwt8mjPy_yYOL1zsYKnEeZFUYrLAC8JhxUYm-xzRVnN6LfAFPxkaK1E0ofPGXNB&m=JKRzQCebPibajqPFZUSAtqGoHMK4Xnd_533X0fndqig&s=mzJxaOGPnCIRlETiKkEindfUOLJ1BRpgkLVlPmnEbNg&e=>

It's possible you've got something in the wrong order?  Or possibly you've hit some unknown bug in the OpenSAML code.  It might also be an issue with the XML DOM/JAXP impl you're using.  What Java platform/vendor/version are you on? Have you done anything special around DOM processing config, like endorse a custom Xerces or anything like that?  Or are you just using the JAXP impl that is internal to your JRE?

________________________________

CONFIDENTIALITY NOTICE
This transmission is intended for the sole use of the individual and/or entity to whom it is addressed, and may contain information and/or attachments that are privileged, confidential and exempt from disclosure under applicable law. If the reader of this transmission is not the intended recipient, you are hereby notified that any disclosure, dissemination, distribution, duplication or the taking of any action in reliance on the contents of this transmission by someone other than the intended addressee or its designated agent is strictly prohibited. If your receipt of this transmission is in error, please notify the sender by replying immediately to this transmission and destroying the transmission. For your protection, do not include Social Security numbers, passwords or other non-public and personal information in your email. Thank you.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20170427/d565853b/attachment-0001.html>