OpenSAML V3: Problems while marshaling encrypted assertion

[Locatelli da Silva, Thiago]

I was able to narrow down the problem and it seems it lies in the EncryptedAssertion. I am able to marshall signed and unsigned assertions, but after I encrypt both assertions, I get the following error with the encrypted assertion:

These are the steps I am following to create my Response with Encrypted Assertion

  1.  Create Assertion (able to marshall)
  2.  Sign Assertion (able to marshall)
  3.  Validate Assertion signature
  4.  Encrypt Assertion (marshaling fails)

Step 3 fails with the following exception: Caused by: org.opensaml.core.xml.io.MarshallingException: Unable to root namespaces of cached DOM element, {http://www.w3.org/2001/04/xmlenc#}EncryptionMethod

There might be missing something with my method that receives and Assertion and returns a EncryptedAssertion. I am currently using JDK 1.8 from Oracle on MacOS and I guess I am using jaxp that is internal to the JRE because the only dependencies on my POM are OpenSAML dependencies.

I care share my project, it has a couple of classes and one unit test that I am validating the migration from V2 to V3.

Thank you

From: dev <dev-bounces at shibboleth.net<mailto:dev-bounces at shibboleth.net>> on behalf of Brent Putman <putmanb at georgetown.edu<mailto:putmanb at georgetown.edu>>
Reply-To: Shib Dev <dev at shibboleth.net<mailto:dev at shibboleth.net>>
Date: Wednesday, April 26, 2017 at 7:12 PM
To: "dev at shibboleth.net<mailto:dev at shibboleth.net>" <dev at shibboleth.net<mailto:dev at shibboleth.net>>
Subject: Re: OpenSAML V3: Problems while marshaling encrypted assertion



On 4/26/17 12:47 PM, Locatelli da Silva, Thiago wrote:
By any chance, does anyone know what I am doing wrong?

http://stackoverflow.com/questions/43636869/error-exception-while-marshalling-signed-and-encrypted-response-opensaml-v3<https://urldefense.proofpoint.com/v2/url?u=http-3A__stackoverflow.com_questions_43636869_error-2Dexception-2Dwhile-2Dmarshalling-2Dsigned-2Dand-2Dencrypted-2Dresponse-2Dopensaml-2Dv3&d=DwMD-g&c=9g4MJkl2VjLjS6R4ei18BA&r=KFwt8mjPy_yYOL1zsYKnEeZFUYrLAC8JhxUYm-xzRVnN6LfAFPxkaK1E0ofPGXNB&m=JKRzQCebPibajqPFZUSAtqGoHMK4Xnd_533X0fndqig&s=q2ylKOxKkxJLslUiDhhIAIrg5dXCEZu8VhwY78afg6M&e=>


I can't see anything obviously wrong with what you are doing.  I suspect that the issue might lie with what you are doing *before* the code you posted there, such as when/how you are encrypting the Assertion and then adding the EncryptedAssertion to the Response; how those XMLObjects are all being constructed, and so on.

I can state with certainty that it does in general work, as we do this very thing in the Shibboleth IdP.  In case it's helpful, here is the OpenSAML profile action component which encrypts Assertions and adds them to the Response, which is used in the IdP for this purpose:

https://git.shibboleth.net/view/?p=java-opensaml.git;a=blob;f=opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/profile/impl/EncryptAssertions.java;hb=HEAD<https://urldefense.proofpoint.com/v2/url?u=https-3A__git.shibboleth.net_view_-3Fp-3Djava-2Dopensaml.git-3Ba-3Dblob-3Bf-3Dopensaml-2Dsaml-2Dimpl_src_main_java_org_opensaml_saml_saml2_profile_impl_EncryptAssertions.java-3Bhb-3DHEAD&d=DwMD-g&c=9g4MJkl2VjLjS6R4ei18BA&r=KFwt8mjPy_yYOL1zsYKnEeZFUYrLAC8JhxUYm-xzRVnN6LfAFPxkaK1E0ofPGXNB&m=JKRzQCebPibajqPFZUSAtqGoHMK4Xnd_533X0fndqig&s=mzJxaOGPnCIRlETiKkEindfUOLJ1BRpgkLVlPmnEbNg&e=>

It's possible you've got something in the wrong order?  Or possibly you've hit some unknown bug in the OpenSAML code.  It might also be an issue with the XML DOM/JAXP impl you're using.  What Java platform/vendor/version are you on? Have you done anything special around DOM processing config, like endorse a custom Xerces or anything like that?  Or are you just using the JAXP impl that is internal to your JRE?

________________________________

CONFIDENTIALITY NOTICE
This transmission is intended for the sole use of the individual and/or entity to whom it is addressed, and may contain information and/or attachments that are privileged, confidential and exempt from disclosure under applicable law. If the reader of this transmission is not the intended recipient, you are hereby notified that any disclosure, dissemination, distribution, duplication or the taking of any action in reliance on the contents of this transmission by someone other than the intended addressee or its designated agent is strictly prohibited. If your receipt of this transmission is in error, please notify the sender by replying immediately to this transmission and destroying the transmission. For your protection, do not include Social Security numbers, passwords or other non-public and personal information in your email. Thank you.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20170427/7866a0ea/attachment.html>