Unable to decrypt assertion in OpenSAML3

[DD K]

Hi Brent,

As you said I figured out that I was doing to much with the two decrypters
during the process of looking after some code examples and cleaned up the
process iin the way you've mentioned. But the thing is still the error
persists. And I've debugged to see whats going on internally and I found
that at class net.shibboleth.utilities.java.support.xml.NameSupport on the
code snippet :

namespaceURI = lookupNamespaceURI(upperNamespaceSearchBound, null,
namespacePrefix);
if (namespaceURI != null) {
    // Namespace resolved outside the subtree where namespaces must be
declared so declare the namespace
    // on this element (within the subtree).
    appendNamespaceDeclaration(domElement, namespaceURI, namespacePrefix);
} else {
    // Namespace couldn't be resolved from any ancestor. If the
namespace prefix is null then the
    // element is simply in the undeclared default document namespace,
which is fine. If it isn't null
    // then a namespace prefix, that hasn't properly been declared, is
being used.
    if (namespacePrefix != null) {
        throw new DOMException(DOMException.NAMESPACE_ERR, "Unable to
resolve namespace prefix "
                + namespacePrefix + " found on element " +
QNameSupport.getNodeQName(domElement));
    }
}


The *namespaceURI* for *namespacePrefix* *ds* is *null*. During debug I've
manually set it to "*http://www.w3.org/2000/09/xmldsig#
<http://www.w3.org/2000/09/xmldsig#>*" then there won't be any errors
thrown and it runs fine. Any idea whats happening?

Any answers would be appreciated,
Thanks,
Deshan Koswatte

On Thu, Sep 5, 2019 at 4:04 AM Brent Putman <putmanb at georgetown.edu> wrote:

>
> On 9/2/19 2:46 AM, DD K wrote:
>
>
> public static Assertion getDecryptedAssertion(EncryptedAssertion encryptedAssertion, X509Credential x509Credential)
>         throws DecryptionException, KeyStoreException, UnrecoverableKeyException, NoSuchAlgorithmException {
>
>     KeyInfoCredentialResolver keyResolver = new StaticKeyInfoCredentialResolver(x509Credential);    Decrypter decrypter = new Decrypter(null, keyResolver, null);    EncryptedKey key = encryptedAssertion.getEncryptedData().getKeyInfo().getEncryptedKeys().get(0);    SecretKey dkey = (SecretKey) decrypter.decryptKey(key, encryptedAssertion.getEncryptedData().
>             getEncryptionMethod().getAlgorithm()); // Error caused here    Credential shared = CredentialSupport.getSimpleCredential(dkey);    decrypter = new Decrypter(new StaticKeyInfoCredentialResolver(shared), null, null);    decrypter.setRootInNewDocument(true);    return decrypter.decrypt(encryptedAssertion);}
>
>
>
> I think your main issue is that you are using 2 different Decrypter
> instances, and you aren't invoking setRootInNewDocument on the first one,
> which (I think) is required by how you are using the output of it.  Try
> that and see how it goes.
>
> A secondary issue is that you don't really need to do all that.  The code
> above is needlessly complicated.  You really just want 1 Decrypter, with
> appropriate ctor args of:
>     - arg 0 as null
>     - arg 1 as the static KeyInfo cred resolver containing the X509 cred
> with private key (assuming you don't want a more realistic resolution
> strategy)
>     - arg 2 as an EncryptedKeyResolver covering how you are placing the
> EncryptedKey relative to the EncryptedData.
>
> Then it handles internally all of what you are doing  - locating and
> decrypting the EncryptedKey to SecretKey, then using that to decrypt the
> EncryptedData.
>
> It's also artificial to encrypt and then immediately decrypt in that
> fashion.  To fully test a round trip you really ought to at least marshall
> the EncryptedAssertion to DOM and then unmarshall a new EncryptedAssertion
> around it. Or even marshall and then serialize it to something (e.g.
> byte[]) and then parse it again and unmarshall.
> --
> To unsubscribe from this list send an email to
> dev-unsubscribe at shibboleth.net
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20190905/78d245a5/attachment.html>