OpenSAML V3: Problems while marshaling encrypted assertion

[Brent Putman]

On 4/27/17 12:35 AM, Locatelli da Silva, Thiago wrote:
>
> These are the steps I am following to create my Response with
> Encrypted Assertion
>
>  1. Create Assertion (able to marshall)
>  2. Sign Assertion (able to marshall)
>  3. Validate Assertion signature
>  4. Encrypt Assertion (marshaling fails)
>
>

If per #3 you really are validating the Signature in the same program
after you sign: I know that historically in some versions of Santuario
(XML security lib) that was a problem.  But not sure about now.  But you
also don't really need to do that, I would think, outside of some
initial testing.  Once you sign, you can be assured it's valid.  It's
also somewhat expensive to do that, if you are concerned about
computational cost.



> There might be missing something with my method that receives and
> Assertion and returns a EncryptedAssertion.

It looks fine to me.  There's not much to encryption, that's a pretty
simple case.  (OTOH, *decryption* has some issues to be aware of there,
wrt the DOM of the decrypted content, as described in the Javadocs).

> I am currently using JDK 1.8 from Oracle on MacOS and I guess I am
> using jaxp that is internal to the JRE because the only dependencies
> on my POM are OpenSAML dependencies.
>

That should be fine.  I mainly just wanted to confirm that you weren't
endorsing some possibly-buggy version of Xerces, etc.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20170427/e9d5cdd6/attachment.html>