<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; color: rgb(0, 0, 0); font-size: 14px; font-family: Calibri, sans-serif; ">
<div>Asaf,</div>
<div><br>
</div>
<div>That all looks ok. One thing that sticks out to me is that you are requesting an AuthnContextClassRef of PasswordProtectedTransport. If the IdP does not have that available, then you may not get anything back but an error message. A few suggestions:</div>
<div><br>
</div>
<div>1. Turn off encryption if you can. Get it working in the simple case before the hard.</div>
<div>2. If you have access to the IdP server logs, turn up logging to DEBUG and see what the logs say. They will tell you exactly what attributes it resolved and which ones it will send (or won't send) to the SP.</div>
<div>3. Turn on debugging on your side and log the SAML XML. Take a look at it and see what it says after you decrypt it.</div>
<div><br>
</div>
<div>Paul</div>
<div><br>
</div>
<span id="OLK_SRC_BODY_SECTION">
<div style="font-family:Calibri; font-size:11pt; text-align:left; color:black; BORDER-BOTTOM: medium none; BORDER-LEFT: medium none; PADDING-BOTTOM: 0in; PADDING-LEFT: 0in; PADDING-RIGHT: 0in; BORDER-TOP: #b5c4df 1pt solid; BORDER-RIGHT: medium none; PADDING-TOP: 3pt">
<span style="font-weight:bold">From: </span>Asaf Peter <<a href="mailto:Asaf.Peter@exlibrisgroup.com">Asaf.Peter@exlibrisgroup.com</a>><br>
<span style="font-weight:bold">Reply-To: </span>Shibboleth Dev <<a href="mailto:dev@shibboleth.net">dev@shibboleth.net</a>><br>
<span style="font-weight:bold">Date: </span>Monday, November 26, 2012 8:21 AM<br>
<span style="font-weight:bold">To: </span>Shibboleth Dev <<a href="mailto:dev@shibboleth.net">dev@shibboleth.net</a>><br>
<span style="font-weight:bold">Subject: </span>RE: Decrypt SAML 2.0 Response<br>
</div>
<div><br>
</div>
<div xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
{mso-style-priority:99;
mso-style-link:"Balloon Text Char";
margin:0in;
margin-bottom:.0001pt;
font-size:8.0pt;
font-family:"Tahoma","sans-serif";}
span.EmailStyle17
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:windowtext;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
span.BalloonTextChar
{mso-style-name:"Balloon Text Char";
mso-style-priority:99;
mso-style-link:"Balloon Text";
font-family:"Tahoma","sans-serif";}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.25in 1.0in 1.25in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
<div lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="color:#1F497D">I am not sure. Attached the AuthenRequest I send to the IDP. Can you figure it out from this?<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">In the attribute-filter.xml on the IDP it says:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><AttributeFilterPolicy id="releaseToSP"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"> <PolicyRequirementRule xsi:type="basic:AttributeRequesterString" value="<a href="http://sp.app.com/mng/login">http://sp.app.com/mng/login</a>" /><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"> <AttributeRule attributeID="givenName"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"> <PermitValueRule xsi:type="basic:ANY" /><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"> </AttributeRule><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"> <AttributeRule attributeID="mail"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"> <PermitValueRule xsi:type="basic:ANY" /><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"> </AttributeRule><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"> <AttributeRule attributeID="uid"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"> <PermitValueRule xsi:type="basic:ANY" /><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"> </AttributeRule><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"> <AttributeRule attributeID="telephoneNumber"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"> <PermitValueRule xsi:type="basic:ANY" /><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"> </AttributeRule><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"> <AttributeRule attributeID="commonName"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"> <PermitValueRule xsi:type="basic:ANY" /><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"> </AttributeRule><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"> </AttributeFilterPolicy><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size: 10pt; font-family: Tahoma, sans-serif; ">From:</span></b><span style="font-size: 10pt; font-family: Tahoma, sans-serif; ">
<a href="mailto:dev-bounces@shibboleth.net">dev-bounces@shibboleth.net</a> [<a href="mailto:dev-bounces@shibboleth.net">mailto:dev-bounces@shibboleth.net</a>]
<b>On Behalf Of </b>Paul Hethmon<br>
<b>Sent:</b> Monday, November 26, 2012 15:14<br>
<b>To:</b> Shib Dev<br>
<b>Subject:</b> Re: Decrypt SAML 2.0 Response<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;color:black">Do you know for certain that the IdP is sending you attribute statements? They are not required to be present.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;color:black">Paul<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;color:black"><o:p> </o:p></span></p>
</div>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="color:black">From: </span></b><span style="color:black">Asaf Peter <<a href="mailto:Asaf.Peter@exlibrisgroup.com">Asaf.Peter@exlibrisgroup.com</a>><br>
<b>Reply-To: </b>Shibboleth Dev <<a href="mailto:dev@shibboleth.net">dev@shibboleth.net</a>><br>
<b>Date: </b>Monday, November 26, 2012 7:34 AM<br>
<b>To: </b>Shibboleth Dev <<a href="mailto:dev@shibboleth.net">dev@shibboleth.net</a>><br>
<b>Subject: </b>Decrypt SAML 2.0 Response<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;color:black"><o:p> </o:p></span></p>
</div>
<div>
<div>
<p class="MsoNormal"><span style="color:#002060">Hi,</span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#002060"> </span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#002060">I get the attached XML response from Shibboleth IDP:</span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#002060"> </span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#002060">I am trying to decrypt it using the following code:</span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black"> <o:p></o:p></span></p>
<p class="MsoNormal" style="text-indent:.5in;text-autospace:none"><span style="font-size:10.0pt;font-family:Consolas;color:black"> </span><span style="font-family:Consolas;color:black">File keyStoreFile =
</span><b><span style="font-family:Consolas;color:#7F0055">new</span></b><span style="font-family:Consolas;color:black"> File(</span><span style="font-family:Consolas;color:#2A00FF">"C:/Users/MyUser/my-private-key.pfx"</span><span style="font-family:Consolas;color:black">);</span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:Consolas;color:black"> String certAlias =
</span><span style="font-family:Consolas;color:#2A00FF">"re-23d2gt1b-779r-39ez-1156-91b3f80eaee2"</span><span style="font-family:Consolas;color:black">;</span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:Consolas;color:black"> String password =
</span><span style="font-family:Consolas;color:#2A00FF">"my_password"</span><span style="font-family:Consolas;color:black">;</span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:Consolas;color:black"> KeyStore keyStore = KeyStore.<i>getInstance</i>(</span><span style="font-family:Consolas;color:#2A00FF">"PKCS12"</span><span style="font-family:Consolas;color:black">);</span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:Consolas;color:black"> keyStore.load(</span><b><span style="font-family:Consolas;color:#7F0055">new</span></b><span style="font-family:Consolas;color:black"> FileInputStream(keyStoreFile),
password.toCharArray());</span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:Consolas;color:black"> RSAPrivateKey privateKey = (RSAPrivateKey) keyStore.getKey(certAlias, password.toCharArray());</span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:Consolas;color:black"> BasicX509Credential decryptionCredential =
</span><b><span style="font-family:Consolas;color:#7F0055">new</span></b><span style="font-family:Consolas;color:black"> BasicX509Credential();</span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:Consolas;color:black"> decryptionCredential.setPrivateKey(privateKey);</span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:Consolas;color:black"> Decrypter decrypter =
</span><b><span style="font-family:Consolas;color:#7F0055">new</span></b><span style="font-family:Consolas;color:black"> Decrypter(</span><b><span style="font-family:Consolas;color:#7F0055">null</span></b><span style="font-family:Consolas;color:black">,
</span><b><span style="font-family:Consolas;color:#7F0055">new</span></b><span style="font-family:Consolas;color:black"> StaticKeyInfoCredentialResolver(decryptionCredential),
</span><b><span style="font-family:Consolas;color:#7F0055">new</span></b><span style="font-family:Consolas;color:black"> InlineEncryptedKeyResolver());</span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:Consolas;color:black"> Assertion decryptedAssertion;</span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:Consolas;color:black">
</span><b><span style="font-family:Consolas;color:#7F0055">try</span></b><span style="font-family:Consolas;color:black"> {</span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:Consolas;color:black"> decryptedAssertion = decrypter.decrypt(response.getEncryptedAssertions().get(0)); //
</span><b><span style="font-family:Consolas;color:red">SUCCESS!!!</span></b><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:Consolas;color:black"> }</span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black"> <o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#002060">The decryption seems to work now – no exception is thrown and I get the decryptedAssertion.</span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#002060">However, I cannot find the user id in the decryptedAssertion.
</span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#002060">The decryptedAssertion.getAttributeStatements() returns an empty list.
</span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#002060">Am I missing something? </span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#002060"> </span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#002060">Thanks,</span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#002060">Asaf</span><span style="color:black"><o:p></o:p></span></p>
</div>
</div>
</div>
</div>
</div>
</span>
</body>
</html>