OpenSAML V3: Problems while marshaling encrypted assertion

[Locatelli da Silva, Thiago]

Brent, thank you for your suggestions.

I removed the unmarshall and the validation code, but the problem remains, investigating a little bit further, my exception says:

Caused by: org.w3c.dom.DOMException: Unable to resolve namespace prefix ds found on element {http://www.w3.org/2000/09/xmldsig#}DigestMethod
at net.shibboleth.utilities.java.support.xml.NamespaceSupport.rootNamespaces(NamespaceSupport.java:247)
at net.shibboleth.utilities.java.support.xml.NamespaceSupport.rootNamespaces(NamespaceSupport.java:295)
at net.shibboleth.utilities.java.support.xml.NamespaceSupport.rootNamespaces(NamespaceSupport.java:200)
at org.opensaml.core.xml.io.AbstractXMLObjectMarshaller.prepareForAdoption(AbstractXMLObjectMarshaller.java:422)
... 40 more

It seems some namespace might be missing during the marshaling of the encrypted assertion. I think the encrypted method worked fine, its this "ds" namespace that might be missing some where after my assertion was encrypted. I am still investigating.

I am going over all source code I can find related to V3, if I find more details, I will post there.

Thank you

From: Brent Putman <putmanb at georgetown.edu<mailto:putmanb at georgetown.edu>>
Date: Thursday, April 27, 2017 at 6:11 PM
To: Shib Dev <dev at shibboleth.net<mailto:dev at shibboleth.net>>, "Locatelli da Silva, Thiago" <thiago.locatellidasilva at transamerica.com<mailto:thiago.locatellidasilva at transamerica.com>>
Subject: Re: OpenSAML V3: Problems while marshaling encrypted assertion



On 4/26/17 9:39 PM, Locatelli da Silva, Thiago wrote:
This is how I am signing the assertion:


    private Assertion createSignedAssertion() throws SamlException {

        try {



            Signature signature = createSignature();

            Assertion assertion = createAssertion();

            assertion.setSignature(signature);


            MarshallerFactory marshallerFactory = XMLObjectProviderRegistrySupport.getMarshallerFactory();

            marshallerFactory.getMarshaller(assertion).marshall(assertion);

            Signer.signObject(signature);


            UnmarshallerFactory unmarshallerFactory = XMLObjectProviderRegistrySupport.getUnmarshallerFactory();

            Assertion signedAssertion = (Assertion) unmarshallerFactory.getUnmarshaller(assertion.getDOM()).unmarshall(assertion.getDOM());


            returnsignedAssertion;



The only thing that looks odd or unusual in your code so far is what you are doing above to unmarshall a new Assertion object after you've signed the input Assertion.  You don't in general have to do that. You just sign it as you are doing and then make use of the existing Assertion instance.  It's already signed. I don't know off-hand if what you are doing could be screwing up the XML namespaces per the exception, but it could be, as it certainly is related to the DOM instances that are cached on the objects.

I would suggest to try just commenting out those two unmarshalling lines above and just return the 'assertion' instance.


________________________________

CONFIDENTIALITY NOTICE
This transmission is intended for the sole use of the individual and/or entity to whom it is addressed, and may contain information and/or attachments that are privileged, confidential and exempt from disclosure under applicable law. If the reader of this transmission is not the intended recipient, you are hereby notified that any disclosure, dissemination, distribution, duplication or the taking of any action in reliance on the contents of this transmission by someone other than the intended addressee or its designated agent is strictly prohibited. If your receipt of this transmission is in error, please notify the sender by replying immediately to this transmission and destroying the transmission. For your protection, do not include Social Security numbers, passwords or other non-public and personal information in your email. Thank you.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20170428/b95dfa1a/attachment-0001.html>