OpenSAML V3: Problems while marshaling encrypted assertion

[Locatelli da Silva, Thiago]

Brent, good morning.

Here I am again,

I found this old discussion from the list, http://shibboleth.1660669.n2.nabble.com/Error-on-signing-outbound-SAML-message-td7621620.html, in which the user is facing the same issue I am facing, even though I am programmatically signing and encrypting, the resulting exception is the same. At the end of the discussion Scott says something about xmlsec 2.x, and looking at my maven dependencies I see xmlsec 1.5.7, which is coming from this dependency


<dependency>

<groupId>org.opensaml</groupId>

<artifactId>xmltooling</artifactId>

<version>1.4.4</version>

</dependency>


I added an exclusion to this dependency so Maven could use the version declared by opensaml-security-api, which is xmlsec 2.0.5. By doing this my problem was fixed. I am now able to encrypt my signed assertions and marshall them.


I am only running into a validation issue with my response, but I think the way I am doing is not valid anymore for OpenSAML V3.


        for(String suiteId : Arrays.asList(

                    "saml2-core-schema-validator",

                    "saml2-core-spec-validator",

                    "saml2-metadata-schema-validator",

                    "saml2-metadata-spec-validator")) {

            ValidatorSuite validatorSuide = new ValidatorSuite(suiteId);

            validatorSuide.validate((XMLObject) response.getDOM());

        }


java.lang.ClassCastException: com.sun.org.apache.xerces.internal.dom.ElementNSImpl cannot be cast to org.opensaml.xml.XMLObject


But this is something I have to look at.


Thank you Bren for your help and suggestions.

From: Brent Putman <putmanb at georgetown.edu<mailto:putmanb at georgetown.edu>>
Date: Thursday, April 27, 2017 at 6:11 PM
To: Shib Dev <dev at shibboleth.net<mailto:dev at shibboleth.net>>, "Locatelli da Silva, Thiago" <thiago.locatellidasilva at transamerica.com<mailto:thiago.locatellidasilva at transamerica.com>>
Subject: Re: OpenSAML V3: Problems while marshaling encrypted assertion



On 4/26/17 9:39 PM, Locatelli da Silva, Thiago wrote:
This is how I am signing the assertion:


    private Assertion createSignedAssertion() throws SamlException {

        try {



            Signature signature = createSignature();

            Assertion assertion = createAssertion();

            assertion.setSignature(signature);


            MarshallerFactory marshallerFactory = XMLObjectProviderRegistrySupport.getMarshallerFactory();

            marshallerFactory.getMarshaller(assertion).marshall(assertion);

            Signer.signObject(signature);


            UnmarshallerFactory unmarshallerFactory = XMLObjectProviderRegistrySupport.getUnmarshallerFactory();

            Assertion signedAssertion = (Assertion) unmarshallerFactory.getUnmarshaller(assertion.getDOM()).unmarshall(assertion.getDOM());


            returnsignedAssertion;



The only thing that looks odd or unusual in your code so far is what you are doing above to unmarshall a new Assertion object after you've signed the input Assertion.  You don't in general have to do that. You just sign it as you are doing and then make use of the existing Assertion instance.  It's already signed. I don't know off-hand if what you are doing could be screwing up the XML namespaces per the exception, but it could be, as it certainly is related to the DOM instances that are cached on the objects.

I would suggest to try just commenting out those two unmarshalling lines above and just return the 'assertion' instance.


________________________________

CONFIDENTIALITY NOTICE
This transmission is intended for the sole use of the individual and/or entity to whom it is addressed, and may contain information and/or attachments that are privileged, confidential and exempt from disclosure under applicable law. If the reader of this transmission is not the intended recipient, you are hereby notified that any disclosure, dissemination, distribution, duplication or the taking of any action in reliance on the contents of this transmission by someone other than the intended addressee or its designated agent is strictly prohibited. If your receipt of this transmission is in error, please notify the sender by replying immediately to this transmission and destroying the transmission. For your protection, do not include Social Security numbers, passwords or other non-public and personal information in your email. Thank you.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20170428/4772bc1c/attachment.html>