OpenSAML Encryption

[Martin Doležal]

Thank you both for your responses! Both helped me to get much further.

Yeah, sounds like me, doing very impressive things our customer asks
for ;-) (if true)

I got myself lost in encryption of SAML XML data previously so I asked
for a help. I left it till the end of my implementation cause there is
not much to encrypt from SP side and we use HTTPS. My problem was that
I was blindly using https://www.samltool.com/encrypt.php so I expected
I need somehow to encrypt complete XML data. But that is of course not
how it works, there are only some kinds of EncryptableObject (class
name from source code) which could be encrypted inside (Assertion,
NameID, Attribute, NewId), at least that's how I understand it now.

And because from my SP side of view I have to send (at least for now)
only AuthnRequest and LogoutRequest then I guess I really need (or may)
to encrypt only NameId in LogoutRequest. After some struggling I was
able to do it now mainly with the help of XMLTooling Unit Tests (thanks
for that hint! It was obvious place to check, so I missed it). NameId
is encrypted to EncryptedId, logout is working, so I am happy for now
:)

Thanks for help again!


On Wed, 2018-11-21 at 23:58 +0000, Cantor, Scott wrote:
> On 11/21/18, 5:00 AM, "dev on behalf of Martin Doležal" <dev-bounces@
> shibboleth.net on behalf of martin.dolezal at noctuint.cz> wrote:
> 
> > I can sign my messages, I can validate signature from IdP, I can
> > decrypt the encrypted messages from IdP (found and modified some
> > samples for each of these cases using
> > xmltooling::CredentialResolver,
> > xmlsignature::SignatureValidator, xmltooling::CredentialResolver
> > and
> > things like that)
> 
> That's very impressive, if true, but you're at serious risk here if
> you did anything wrong. Please just use an existing SP
> implementation.
> 
> >  but I have no idea how to encrypt my requests, such as
> > AuthnRequest.
> 
> There is nothing to encrypt.
> 
> > I have Stefan Rasmusson’s book where it is described how to do it
> > in Java
> 
> I seriously doubt that unless you're talking about encrypting a
> NameID in an AuthnRequest, and that's an unusual and unnecessary use
> case.
> 
> -- Scott
> 
>