<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<br>
<div class="moz-cite-prefix">On 10/21/12 12:24 PM, rangeli nepal
wrote:<br>
</div>
<blockquote
cite="mid:CAA0FH9FCSA57ORue8YzoCmBePSEQKF_xUR2GYoZE1+EvV+Ytzw@mail.gmail.com"
type="cite">
<pre wrap="">
However program fails with following message:
org.opensaml.xml.encryption.DecryptionException: Failed to decrypt EncryptedData
at org.opensaml.xml.encryption.Decrypter.decryptDataToDOM(Decrypter.java:523)
at org.opensaml.xml.encryption.Decrypter.decryptDataToList(Decrypter.java:439)
at org.opensaml.xml.encryption.Decrypter.decryptData(Decrypter.java:400)
at org.opensaml.saml2.encryption.Decrypter.decryptData(Decrypter.java:140)
at org.opensaml.saml2.encryption.Decrypter.decrypt(Decrypter.java:68)
at com.mountaintop.saml.AssertionDecryptor.decryptAssertion(AssertionDecryptor.java:55)</pre>
</blockquote>
<br>
<br>
Turning up to DEBUG logging would probably provide some more useful
info, but I think I see the problem...<br>
<br>
<br>
<br>
<blockquote
cite="mid:CAA0FH9FCSA57ORue8YzoCmBePSEQKF_xUR2GYoZE1+EvV+Ytzw@mail.gmail.com"
type="cite">
<pre wrap="">
samlEncrypter.setKeyPlacement(KeyPlacement.PEER);
</pre>
</blockquote>
<br>
On encryption, you're specifying key placement as PEER (versus
INLINE).<br>
<br>
<br>
<br>
<blockquote
cite="mid:CAA0FH9FCSA57ORue8YzoCmBePSEQKF_xUR2GYoZE1+EvV+Ytzw@mail.gmail.com"
type="cite">
<pre wrap="">
Decrypter samlDecrypter =
new Decrypter(null, skicr, new InlineEncryptedKeyResolver());
</pre>
</blockquote>
<br>
<br>
On decryption, you're specifying (only) an inline EncryptedKey
resolver.<br>
<br>
<br>
Your problem is: the latter isn't going to find the EncryptedKey
placed by the former. Please read the Javadocs on PEER vs INLINE
key placement and the various EncryptedKeyResolver impls. Your
options are:<br>
<br>
1) instead use INLINE key placement<br>
<br>
2) instead use the EncryptedElementTypeEncryptedKeyResolver (which
is appropriate for PEER key placement)<br>
<br>
3) (best for real world) Since you may not be able to make
assumptions about where the key is placed by whoever encrypted it,
just use a ChainingEncryptedKeyResolver with all the
EncryptedKeyResolver impls to cover all the bases, as illustrated in
the more complex decryption example in the wiki.<br>
<br>
<br>
<br>
<br>
<meta http-equiv="content-type" content="text/html;
charset=ISO-8859-1">
</body>
</html>