Unable to decrypt assertion in OpenSAML3

[DD K]

Hi Brent,

My bad the OpenSAML2 version had the round about coding snippets and when I
changed it both look more like the same but I was not able to debug it in
deep. on the outer it looks more over the same

Any answers would be appreciated,
Thanks,
Deshan Koswatte

On Sun, Sep 8, 2019 at 1:24 PM DD K <ddk05361 at gmail.com> wrote:

> Hi Brent,
>
> I've tried to marshall the encrypted assertion but the same error
> persists. I've debugged by comparing the OpenSAML2 project with the current
> OpenSAML3 project. In OpenSAML2 project, the encrypted Assertion had a dom
> and the encryptedData had the element [ds:KeyInfo:null] but in OpenSAML3 I
> don't see those. I currently have no idea what is happening in the process.
>
> Encrypting Logic after the update
>
> public EncryptedAssertion doEncryptedAssertion(Assertion assertion, X509Credential cred, String alias, String
>             assertionEncryptionAlgorithm, String keyEncryptionAlgorithm) throws IdentityException {
>         try {
>             DataEncryptionParameters encParams = new DataEncryptionParameters();
>             encParams.setAlgorithm(assertionEncryptionAlgorithm);
>
>             KeyEncryptionParameters keyEncryptionParameters = new KeyEncryptionParameters();
>             keyEncryptionParameters.setAlgorithm(keyEncryptionAlgorithm);
>             keyEncryptionParameters.setEncryptionCredential(cred);
>
>             Encrypter encrypter = new Encrypter(encParams, keyEncryptionParameters);
>             encrypter.setKeyPlacement(Encrypter.KeyPlacement.INLINE);
>
>             EncryptedAssertion encrypted = encrypter.encrypt(assertion);
>             return encrypted;
>         } catch (Exception e) {
>             throw IdentityException.error("Error while Encrypting Assertion", e);
>         }
>     }
>
>
> Decrypting Logic after the update
>
> public static Assertion getDecryptedAssertion(EncryptedAssertion encryptedAssertion, X509Credential x509Credential)
>             throws DecryptionException {
>
>         KeyInfoCredentialResolver keyResolver = new StaticKeyInfoCredentialResolver(x509Credential);
>         Decrypter decrypter = new Decrypter(null, keyResolver, new InlineEncryptedKeyResolver());
>
>         decrypter.setRootInNewDocument(true);
>         return decrypter.decrypt(encryptedAssertion);
>     }
>
>
> Any answers would be appreciated,
> Thanks,
> Deshan Koswatte
>
>
> On Fri, Sep 6, 2019 at 6:42 AM Brent Putman <putmanb at georgetown.edu>
> wrote:
>
>>
>> On 9/5/19 5:03 AM, DD K wrote:
>>
>>  But the thing is still the error persists. And I've debugged to see
>> whats going on internally and I found that at class
>> net.shibboleth.utilities.java.support.xml.NameSupport on the code snippet :
>>
>> The *namespaceURI* for *namespacePrefix* *ds* is *null*. During debug
>> I've manually set it to "*http://www.w3.org/2000/09/xmldsig#
>> <http://www.w3.org/2000/09/xmldsig#>*" then there won't be any errors
>> thrown and it runs fine. Any idea whats happening?
>>
>> I'm not 100% sure, but I suspect it might be related to the round
>> tripping you're doing in your testing.  Probably something related to the
>> DOM being re-used is causing a problem with all the complex namespace
>> handling we have to do.  The 'ds' prefix for XML Signature is a common one
>> and ought to be in the EncryptedAssertion in the correct place.  We know it
>> is in real world use cases, this code has been in production use for over
>> 12 years or so.
>>
>> For this kind of artificial testing, I'd try my earlier suggestion: After
>> encryption, completely marshall and serialize the EncryptedAssertion to
>> something, like a temp File or byte[]; then parse the File/byte[]/etc and
>> unmarshall to get a fresh new EncryptedAssertion, and then decrypt that.
>>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20190909/d683d87a/attachment.html>