Unable to decrypt assertion in OpenSAML3

DD K ddk05361 at gmail.com
Mon Sep 2 02:46:03 EDT 2019 

Hi All,

I'm having a test to encrypt and then decrypt a saml assertion. The
assertion gets encrypted but when you try to decrypt I'm getting an error.
The error is as follows:

*Error*

[main] ERROR org.opensaml.core.xml.io.AbstractXMLObjectMarshaller - Unable
to root namespaces of cached DOM element, {
http://www.w3.org/2001/04/xmlenc#}EncryptionMethod
org.w3c.dom.DOMException: Unable to resolve namespace prefix ds found on
element {http://www.w3.org/2000/09/xmldsig#}DigestMethod
at
net.shibboleth.utilities.java.support.xml.NamespaceSupport.rootNamespaces(NamespaceSupport.java:247)
at
net.shibboleth.utilities.java.support.xml.NamespaceSupport.rootNamespaces(NamespaceSupport.java:295)
at
net.shibboleth.utilities.java.support.xml.NamespaceSupport.rootNamespaces(NamespaceSupport.java:200)
at
org.opensaml.core.xml.io.AbstractXMLObjectMarshaller.prepareForAdoption(AbstractXMLObjectMarshaller.java:422)
at
org.opensaml.core.xml.io.AbstractXMLObjectMarshaller.marshall(AbstractXMLObjectMarshaller.java:144)
at
org.opensaml.core.xml.io.AbstractXMLObjectMarshaller.marshallChildElements(AbstractXMLObjectMarshaller.java:271)
at
org.opensaml.core.xml.io.AbstractXMLObjectMarshaller.marshallInto(AbstractXMLObjectMarshaller.java:212)
at
org.opensaml.core.xml.io.AbstractXMLObjectMarshaller.marshall(AbstractXMLObjectMarshaller.java:118)
at
org.opensaml.core.xml.io.AbstractXMLObjectMarshaller.marshall(AbstractXMLObjectMarshaller.java:75)
at
org.opensaml.xmlsec.encryption.support.Decrypter.checkAndMarshall(Decrypter.java:963)
at
org.opensaml.xmlsec.encryption.support.Decrypter.decryptKey(Decrypter.java:681)
at
org.opensaml.xmlsec.encryption.support.Decrypter.decryptKey(Decrypter.java:643)
at
org.wso2.carbon.identity.sso.saml.TestUtils.getDecryptedAssertion(TestUtils.java:141)
at
org.wso2.carbon.identity.sso.saml.util.EncryptionTests.testSetEncryptedAssertionWithKeyEncryptionAlgorithm(EncryptionTests.java:77)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at
sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
at
sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke(Method.java:498)
at
org.testng.internal.MethodInvocationHelper.invokeMethod(MethodInvocationHelper.java:86)
at org.testng.internal.Invoker.invokeMethod(Invoker.java:643)
at org.testng.internal.Invoker.invokeTestMethod(Invoker.java:820)
at org.testng.internal.Invoker.invokeTestMethods(Invoker.java:1128)
at
org.testng.internal.TestMethodWorker.invokeTestMethods(TestMethodWorker.java:129)
at org.testng.internal.TestMethodWorker.run(TestMethodWorker.java:112)
at org.testng.TestRunner.privateRun(TestRunner.java:782)
at org.testng.TestRunner.run(TestRunner.java:632)
at org.testng.SuiteRunner.runTest(SuiteRunner.java:366)
at org.testng.SuiteRunner.runSequentially(SuiteRunner.java:361)
at org.testng.SuiteRunner.privateRun(SuiteRunner.java:319)
at org.testng.SuiteRunner.run(SuiteRunner.java:268)
at org.testng.SuiteRunnerWorker.runSuite(SuiteRunnerWorker.java:52)
at org.testng.SuiteRunnerWorker.run(SuiteRunnerWorker.java:86)
at org.testng.TestNG.runSuitesSequentially(TestNG.java:1244)
at org.testng.TestNG.runSuitesLocally(TestNG.java:1169)
at org.testng.TestNG.run(TestNG.java:1064)
at org.testng.IDEARemoteTestNG.run(IDEARemoteTestNG.java:72)
at org.testng.RemoteTestNGStarter.main(RemoteTestNGStarter.java:123)
[main] ERROR org.opensaml.xmlsec.encryption.support.Decrypter - Error
marshalling target XMLObject
org.opensaml.core.xml.io.MarshallingException: Unable to root namespaces of
cached DOM element, {http://www.w3.org/2001/04/xmlenc#}EncryptionMethod
at
org.opensaml.core.xml.io.AbstractXMLObjectMarshaller.prepareForAdoption(AbstractXMLObjectMarshaller.java:427)
at
org.opensaml.core.xml.io.AbstractXMLObjectMarshaller.marshall(AbstractXMLObjectMarshaller.java:144)
at
org.opensaml.core.xml.io.AbstractXMLObjectMarshaller.marshallChildElements(AbstractXMLObjectMarshaller.java:271)
at
org.opensaml.core.xml.io.AbstractXMLObjectMarshaller.marshallInto(AbstractXMLObjectMarshaller.java:212)
at
org.opensaml.core.xml.io.AbstractXMLObjectMarshaller.marshall(AbstractXMLObjectMarshaller.java:118)
at
org.opensaml.core.xml.io.AbstractXMLObjectMarshaller.marshall(AbstractXMLObjectMarshaller.java:75)
at
org.opensaml.xmlsec.encryption.support.Decrypter.checkAndMarshall(Decrypter.java:963)
at
org.opensaml.xmlsec.encryption.support.Decrypter.decryptKey(Decrypter.java:681)
at
org.opensaml.xmlsec.encryption.support.Decrypter.decryptKey(Decrypter.java:643)
at
org.wso2.carbon.identity.sso.saml.TestUtils.getDecryptedAssertion(TestUtils.java:141)
at
org.wso2.carbon.identity.sso.saml.util.EncryptionTests.testSetEncryptedAssertionWithKeyEncryptionAlgorithm(EncryptionTests.java:77)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at
sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
at
sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke(Method.java:498)
at
org.testng.internal.MethodInvocationHelper.invokeMethod(MethodInvocationHelper.java:86)
at org.testng.internal.Invoker.invokeMethod(Invoker.java:643)
at org.testng.internal.Invoker.invokeTestMethod(Invoker.java:820)
at org.testng.internal.Invoker.invokeTestMethods(Invoker.java:1128)
at
org.testng.internal.TestMethodWorker.invokeTestMethods(TestMethodWorker.java:129)
at org.testng.internal.TestMethodWorker.run(TestMethodWorker.java:112)
at org.testng.TestRunner.privateRun(TestRunner.java:782)
at org.testng.TestRunner.run(TestRunner.java:632)
at org.testng.SuiteRunner.runTest(SuiteRunner.java:366)
at org.testng.SuiteRunner.runSequentially(SuiteRunner.java:361)
at org.testng.SuiteRunner.privateRun(SuiteRunner.java:319)
at org.testng.SuiteRunner.run(SuiteRunner.java:268)
at org.testng.SuiteRunnerWorker.runSuite(SuiteRunnerWorker.java:52)
at org.testng.SuiteRunnerWorker.run(SuiteRunnerWorker.java:86)
at org.testng.TestNG.runSuitesSequentially(TestNG.java:1244)
at org.testng.TestNG.runSuitesLocally(TestNG.java:1169)
at org.testng.TestNG.run(TestNG.java:1064)
at org.testng.IDEARemoteTestNG.run(IDEARemoteTestNG.java:72)
at org.testng.RemoteTestNGStarter.main(RemoteTestNGStarter.java:123)
Caused by: org.w3c.dom.DOMException: Unable to resolve namespace prefix ds
found on element {http://www.w3.org/2000/09/xmldsig#}DigestMethod
at
net.shibboleth.utilities.java.support.xml.NamespaceSupport.rootNamespaces(NamespaceSupport.java:247)
at
net.shibboleth.utilities.java.support.xml.NamespaceSupport.rootNamespaces(NamespaceSupport.java:295)
at
net.shibboleth.utilities.java.support.xml.NamespaceSupport.rootNamespaces(NamespaceSupport.java:200)
at
org.opensaml.core.xml.io.AbstractXMLObjectMarshaller.prepareForAdoption(AbstractXMLObjectMarshaller.java:422)
... 33 more
[main] ERROR org.opensaml.xmlsec.encryption.support.Decrypter - Error
marshalling EncryptedKey for decryption
org.opensaml.xmlsec.encryption.support.DecryptionException: Error
marshalling target XMLObject
at
org.opensaml.xmlsec.encryption.support.Decrypter.checkAndMarshall(Decrypter.java:966)
at
org.opensaml.xmlsec.encryption.support.Decrypter.decryptKey(Decrypter.java:681)
at
org.opensaml.xmlsec.encryption.support.Decrypter.decryptKey(Decrypter.java:643)
at
org.wso2.carbon.identity.sso.saml.TestUtils.getDecryptedAssertion(TestUtils.java:141)
at
org.wso2.carbon.identity.sso.saml.util.EncryptionTests.testSetEncryptedAssertionWithKeyEncryptionAlgorithm(EncryptionTests.java:77)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at
sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
at
sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke(Method.java:498)
at
org.testng.internal.MethodInvocationHelper.invokeMethod(MethodInvocationHelper.java:86)
at org.testng.internal.Invoker.invokeMethod(Invoker.java:643)
at org.testng.internal.Invoker.invokeTestMethod(Invoker.java:820)
at org.testng.internal.Invoker.invokeTestMethods(Invoker.java:1128)
at
org.testng.internal.TestMethodWorker.invokeTestMethods(TestMethodWorker.java:129)
at org.testng.internal.TestMethodWorker.run(TestMethodWorker.java:112)
at org.testng.TestRunner.privateRun(TestRunner.java:782)
at org.testng.TestRunner.run(TestRunner.java:632)
at org.testng.SuiteRunner.runTest(SuiteRunner.java:366)
at org.testng.SuiteRunner.runSequentially(SuiteRunner.java:361)
at org.testng.SuiteRunner.privateRun(SuiteRunner.java:319)
at org.testng.SuiteRunner.run(SuiteRunner.java:268)
at org.testng.SuiteRunnerWorker.runSuite(SuiteRunnerWorker.java:52)
at org.testng.SuiteRunnerWorker.run(SuiteRunnerWorker.java:86)
at org.testng.TestNG.runSuitesSequentially(TestNG.java:1244)
at org.testng.TestNG.runSuitesLocally(TestNG.java:1169)
at org.testng.TestNG.run(TestNG.java:1064)
at org.testng.IDEARemoteTestNG.run(IDEARemoteTestNG.java:72)
at org.testng.RemoteTestNGStarter.main(RemoteTestNGStarter.java:123)
Caused by: org.opensaml.core.xml.io.MarshallingException: Unable to root
namespaces of cached DOM element, {
http://www.w3.org/2001/04/xmlenc#}EncryptionMethod
at
org.opensaml.core.xml.io.AbstractXMLObjectMarshaller.prepareForAdoption(AbstractXMLObjectMarshaller.java:427)
at
org.opensaml.core.xml.io.AbstractXMLObjectMarshaller.marshall(AbstractXMLObjectMarshaller.java:144)
at
org.opensaml.core.xml.io.AbstractXMLObjectMarshaller.marshallChildElements(AbstractXMLObjectMarshaller.java:271)
at
org.opensaml.core.xml.io.AbstractXMLObjectMarshaller.marshallInto(AbstractXMLObjectMarshaller.java:212)
at
org.opensaml.core.xml.io.AbstractXMLObjectMarshaller.marshall(AbstractXMLObjectMarshaller.java:118)
at
org.opensaml.core.xml.io.AbstractXMLObjectMarshaller.marshall(AbstractXMLObjectMarshaller.java:75)
at
org.opensaml.xmlsec.encryption.support.Decrypter.checkAndMarshall(Decrypter.java:963)
... 27 more
Caused by: org.w3c.dom.DOMException: Unable to resolve namespace prefix ds
found on element {http://www.w3.org/2000/09/xmldsig#}DigestMethod
at
net.shibboleth.utilities.java.support.xml.NamespaceSupport.rootNamespaces(NamespaceSupport.java:247)
at
net.shibboleth.utilities.java.support.xml.NamespaceSupport.rootNamespaces(NamespaceSupport.java:295)
at
net.shibboleth.utilities.java.support.xml.NamespaceSupport.rootNamespaces(NamespaceSupport.java:200)
at
org.opensaml.core.xml.io.AbstractXMLObjectMarshaller.prepareForAdoption(AbstractXMLObjectMarshaller.java:422)
... 33 more
[main] ERROR org.opensaml.xmlsec.encryption.support.Decrypter - Failed to
decrypt EncryptedKey, valid decryption key could not be resolved

org.opensaml.xmlsec.encryption.support.DecryptionException: Valid
decryption key for EncryptedKey could not be resolved

at
org.opensaml.xmlsec.encryption.support.Decrypter.decryptKey(Decrypter.java:655)
at
org.wso2.carbon.identity.sso.saml.TestUtils.getDecryptedAssertion(TestUtils.java:141)
at
org.wso2.carbon.identity.sso.saml.util.EncryptionTests.testSetEncryptedAssertionWithKeyEncryptionAlgorithm(EncryptionTests.java:77)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at
sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
at
sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke(Method.java:498)
at
org.testng.internal.MethodInvocationHelper.invokeMethod(MethodInvocationHelper.java:86)
at org.testng.internal.Invoker.invokeMethod(Invoker.java:643)
at org.testng.internal.Invoker.invokeTestMethod(Invoker.java:820)
at org.testng.internal.Invoker.invokeTestMethods(Invoker.java:1128)
at
org.testng.internal.TestMethodWorker.invokeTestMethods(TestMethodWorker.java:129)
at org.testng.internal.TestMethodWorker.run(TestMethodWorker.java:112)
at org.testng.TestRunner.privateRun(TestRunner.java:782)
at org.testng.TestRunner.run(TestRunner.java:632)
at org.testng.SuiteRunner.runTest(SuiteRunner.java:366)
at org.testng.SuiteRunner.runSequentially(SuiteRunner.java:361)
at org.testng.SuiteRunner.privateRun(SuiteRunner.java:319)
at org.testng.SuiteRunner.run(SuiteRunner.java:268)
at org.testng.SuiteRunnerWorker.runSuite(SuiteRunnerWorker.java:52)
at org.testng.SuiteRunnerWorker.run(SuiteRunnerWorker.java:86)
at org.testng.TestNG.runSuitesSequentially(TestNG.java:1244)
at org.testng.TestNG.runSuitesLocally(TestNG.java:1169)
at org.testng.TestNG.run(TestNG.java:1064)
at org.testng.IDEARemoteTestNG.run(IDEARemoteTestNG.java:72)
at org.testng.RemoteTestNGStarter.main(RemoteTestNGStarter.java:123)

*Error sources:*

public void testSetEncryptedAssertionWithKeyEncryptionAlgorithm()
throws Exception {

    Security.addProvider(new BouncyCastleProvider());
    Assertion assertion = SAMLTestAssertionBuilder.buildDefaultSAMLAssertion();
    SAMLSSOUtil.doBootstrap();

    prepareForAssertionEncryption();
    EncryptedAssertion encryptedAssertion =
SAMLSSOUtil.setEncryptedAssertion(assertion,
            TestConstants.ASSERTION_ENCRYPTION_ALGO,
TestConstants.KEY_ENCRYPTION_ALGO, TestConstants.WSO2_CARBON,
            "carbon.super");

    TestUtils.prepareCredentials(x509Credential);
    Assertion decryptedAssertion =
TestUtils.getDecryptedAssertion(encryptedAssertion, x509Credential);
// Error caused here

    assertEncryptedSAMLAssertion(assertion, encryptedAssertion,
decryptedAssertion);
}


public static Assertion getDecryptedAssertion(EncryptedAssertion
encryptedAssertion, X509Credential x509Credential)
        throws DecryptionException, KeyStoreException,
UnrecoverableKeyException, NoSuchAlgorithmException {

    KeyInfoCredentialResolver keyResolver = new
StaticKeyInfoCredentialResolver(x509Credential);
    Decrypter decrypter = new Decrypter(null, keyResolver, null);

    EncryptedKey key =
encryptedAssertion.getEncryptedData().getKeyInfo().getEncryptedKeys().get(0);
    SecretKey dkey = (SecretKey) decrypter.decryptKey(key,
encryptedAssertion.getEncryptedData().
            getEncryptionMethod().getAlgorithm()); // Error caused here
    Credential shared = CredentialSupport.getSimpleCredential(dkey);

    decrypter = new Decrypter(new
StaticKeyInfoCredentialResolver(shared), null, null);
    decrypter.setRootInNewDocument(true);
    return decrypter.decrypt(encryptedAssertion);
}


Useful links found were as below :

   1.
   https://shibboleth.1660669.n2.nabble.com/Error-on-signing-outbound-SAML-message-td7621620.html
   2.
   https://shibboleth.1660669.n2.nabble.com/OpenSAML-V3-Problems-while-marshaling-encrypted-assertion-td7632834.html

These links pointed out that there is a clash between xmlsec-1.5.6 and
xmlsec-2.0.5. but the thing is when i check the dependency tree I can only
find xmlsec-2.0.5.
Can anyone point out what this issue really is?

Any answers would be appreciated,
Deshan Koswatte
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20190902/93014be9/attachment-0001.html>

More information about the dev mailing list