Unable to decrypt assertion in OpenSAML3

[Brent Putman]

On 9/5/19 5:03 AM, DD K wrote:
>  But the thing is still the error persists. And I've debugged to see
> whats going on internally and I found that at class
> net.shibboleth.utilities.java.support.xml.NameSupport on the code
> snippet :
>
> The /namespaceURI/ for /namespacePrefix/ *ds* is *null*. During debug
> I've manually set it to "/*http://www.w3.org/2000/09/xmldsig#*/" then
> there won't be any errors thrown and it runs fine. Any idea whats
> happening?
>
I'm not 100% sure, but I suspect it might be related to the round
tripping you're doing in your testing.  Probably something related to
the DOM being re-used is causing a problem with all the complex
namespace handling we have to do.  The 'ds' prefix for XML Signature is
a common one and ought to be in the EncryptedAssertion in the correct
place.  We know it is in real world use cases, this code has been in
production use for over 12 years or so.

For this kind of artificial testing, I'd try my earlier suggestion:
After encryption, completely marshall and serialize the
EncryptedAssertion to something, like a temp File or byte[]; then parse
the File/byte[]/etc and unmarshall to get a fresh new
EncryptedAssertion, and then decrypt that.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20190905/adfc622f/attachment.html>