Unable to decrypt assertion in OpenSAML3

[DD K]

Hi Brent,

I've tried to marshall the encrypted assertion but the same error persists.
I've debugged by comparing the OpenSAML2 project with the current OpenSAML3
project. In OpenSAML2 project, the encrypted Assertion had a dom and the
encryptedData had the element [ds:KeyInfo:null] but in OpenSAML3 I don't
see those. I currently have no idea what is happening in the process.

Encrypting Logic after the update

public EncryptedAssertion doEncryptedAssertion(Assertion assertion,
X509Credential cred, String alias, String
            assertionEncryptionAlgorithm, String
keyEncryptionAlgorithm) throws IdentityException {
        try {
            DataEncryptionParameters encParams = new DataEncryptionParameters();
            encParams.setAlgorithm(assertionEncryptionAlgorithm);

            KeyEncryptionParameters keyEncryptionParameters = new
KeyEncryptionParameters();
            keyEncryptionParameters.setAlgorithm(keyEncryptionAlgorithm);
            keyEncryptionParameters.setEncryptionCredential(cred);

            Encrypter encrypter = new Encrypter(encParams,
keyEncryptionParameters);
            encrypter.setKeyPlacement(Encrypter.KeyPlacement.INLINE);

            EncryptedAssertion encrypted = encrypter.encrypt(assertion);
            return encrypted;
        } catch (Exception e) {
            throw IdentityException.error("Error while Encrypting
Assertion", e);
        }
    }


Decrypting Logic after the update

public static Assertion getDecryptedAssertion(EncryptedAssertion
encryptedAssertion, X509Credential x509Credential)
            throws DecryptionException {

        KeyInfoCredentialResolver keyResolver = new
StaticKeyInfoCredentialResolver(x509Credential);
        Decrypter decrypter = new Decrypter(null, keyResolver, new
InlineEncryptedKeyResolver());

        decrypter.setRootInNewDocument(true);
        return decrypter.decrypt(encryptedAssertion);
    }


Any answers would be appreciated,
Thanks,
Deshan Koswatte


On Fri, Sep 6, 2019 at 6:42 AM Brent Putman <putmanb at georgetown.edu> wrote:

>
> On 9/5/19 5:03 AM, DD K wrote:
>
>  But the thing is still the error persists. And I've debugged to see whats
> going on internally and I found that at class
> net.shibboleth.utilities.java.support.xml.NameSupport on the code snippet :
>
> The *namespaceURI* for *namespacePrefix* *ds* is *null*. During debug
> I've manually set it to "*http://www.w3.org/2000/09/xmldsig#
> <http://www.w3.org/2000/09/xmldsig#>*" then there won't be any errors
> thrown and it runs fine. Any idea whats happening?
>
> I'm not 100% sure, but I suspect it might be related to the round tripping
> you're doing in your testing.  Probably something related to the DOM being
> re-used is causing a problem with all the complex namespace handling we
> have to do.  The 'ds' prefix for XML Signature is a common one and ought to
> be in the EncryptedAssertion in the correct place.  We know it is in real
> world use cases, this code has been in production use for over 12 years or
> so.
>
> For this kind of artificial testing, I'd try my earlier suggestion: After
> encryption, completely marshall and serialize the EncryptedAssertion to
> something, like a temp File or byte[]; then parse the File/byte[]/etc and
> unmarshall to get a fresh new EncryptedAssertion, and then decrypt that.
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20190908/4ed52cd4/attachment.html>