Error decrypting assertion

[Brent Putman]

On 9/6/21 10:25 AM, aabiabdallah at gmail.com wrote:
> Hello everyone,
>
> I was experimenting with a project using OpenSAML V3


V3 has been EOL for a very long time, and is totally unsupported.  
Please consider updating to V4.



> and I was able to successfully read assertions and their attributes. 
> However, when I try to using Decrypter to decrypt an encrypted 
> assertion I can an error (see below stack trace). Does anyone know 
> what the root cause of this issue might be?


I don't see any obvious issue with the XML of the actual Response 
message you posted.  Based on the error:


> Caused by: org.xml.sax.SAXParseException; lineNumber: 1; 
> columnNumber: 214; The prefix "saml" for element "saml:Assertion" is 
> not bound.


there's something wrong with the decl of the SAML 2 Core namespace - 
it's missing in a context where it needs to be present.  Possibly in 
the decrypted Assertion the 'saml' prefix is used and not declared with 
an 'xmlns:saml' in the Assertion.

Or could be you are using the OpenSAML components improperly, and the 
namespaces aren't getting processed properly.  It's hard to tell from 
what you posted.



> <xenc:EncryptionMethod 
> Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-1_5"/ 
> <http://www.w3.org/2001/04/xmlenc#rsa-1_5%22/>>

Not related to your question or problem, but RSA 1.5 has been 
considered weak and insecure for some time now.  Modern versions of 
OpenSAML exclude that from acceptability - at least in the components 
that use the algorithm include/exclude lists - and so won't even 
process it successfully.

You should consider asking the encrypting party to use a more modern 
RSA key encryption algorithm here, if possible.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20210909/30b3f00a/attachment.htm>