<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
{mso-style-priority:99;
mso-style-link:"Balloon Text Char";
margin:0in;
margin-bottom:.0001pt;
font-size:8.0pt;
font-family:"Tahoma","sans-serif";}
span.BalloonTextChar
{mso-style-name:"Balloon Text Char";
mso-style-priority:99;
mso-style-link:"Balloon Text";
font-family:"Tahoma","sans-serif";}
span.EmailStyle19
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:windowtext;}
span.EmailStyle20
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:#1F497D;}
span.EmailStyle21
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.25in 1.0in 1.25in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="color:#1F497D">Hi Paul,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">How do I turn off encryption?<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Thanks,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Asaf<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> dev-bounces@shibboleth.net [mailto:dev-bounces@shibboleth.net]
<b>On Behalf Of </b>Paul Hethmon<br>
<b>Sent:</b> Monday, November 26, 2012 15:30<br>
<b>To:</b> Shib Dev<br>
<b>Subject:</b> Re: Decrypt SAML 2.0 Response<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;color:black">Asaf,<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;color:black">That all looks ok. One thing that sticks out to me is that you are requesting an AuthnContextClassRef of PasswordProtectedTransport. If the IdP does not have that available, then you may not get
anything back but an error message. A few suggestions:<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;color:black">1. Turn off encryption if you can. Get it working in the simple case before the hard.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;color:black">2. If you have access to the IdP server logs, turn up logging to DEBUG and see what the logs say. They will tell you exactly what attributes it resolved and which ones it will send (or won't send)
to the SP.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;color:black">3. Turn on debugging on your side and log the SAML XML. Take a look at it and see what it says after you decrypt it.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;color:black">Paul<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;color:black"><o:p> </o:p></span></p>
</div>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="color:black">From: </span></b><span style="color:black">Asaf Peter <<a href="mailto:Asaf.Peter@exlibrisgroup.com">Asaf.Peter@exlibrisgroup.com</a>><br>
<b>Reply-To: </b>Shibboleth Dev <<a href="mailto:dev@shibboleth.net">dev@shibboleth.net</a>><br>
<b>Date: </b>Monday, November 26, 2012 8:21 AM<br>
<b>To: </b>Shibboleth Dev <<a href="mailto:dev@shibboleth.net">dev@shibboleth.net</a>><br>
<b>Subject: </b>RE: Decrypt SAML 2.0 Response<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;color:black"><o:p> </o:p></span></p>
</div>
<div>
<div>
<p class="MsoNormal"><span style="color:#1F497D">I am not sure. Attached the AuthenRequest I send to the IDP. Can you figure it out from this?</span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"> </span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">In the attribute-filter.xml on the IDP it says:</span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"> </span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><AttributeFilterPolicy id="releaseToSP"></span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"> <PolicyRequirementRule xsi:type="basic:AttributeRequesterString" value="<a href="http://sp.app.com/mng/login">http://sp.app.com/mng/login</a>" /></span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"> </span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"> <AttributeRule attributeID="givenName"></span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"> <PermitValueRule xsi:type="basic:ANY" /></span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"> </AttributeRule></span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"> <AttributeRule attributeID="mail"></span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"> <PermitValueRule xsi:type="basic:ANY" /></span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"> </AttributeRule></span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"> <AttributeRule attributeID="uid"></span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"> <PermitValueRule xsi:type="basic:ANY" /></span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"> </AttributeRule></span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"> <AttributeRule attributeID="telephoneNumber"></span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"> <PermitValueRule xsi:type="basic:ANY" /></span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"> </AttributeRule></span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"> <AttributeRule attributeID="commonName"></span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"> <PermitValueRule xsi:type="basic:ANY" /></span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"> </AttributeRule></span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"> </AttributeFilterPolicy></span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"> </span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"> </span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"> </span><span style="color:black"><o:p></o:p></span></p>
<div>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif";color:black">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif";color:black">
<a href="mailto:dev-bounces@shibboleth.net">dev-bounces@shibboleth.net</a> [<a href="mailto:dev-bounces@shibboleth.net">mailto:dev-bounces@shibboleth.net</a>]
<b>On Behalf Of </b>Paul Hethmon<br>
<b>Sent:</b> Monday, November 26, 2012 15:14<br>
<b>To:</b> Shib Dev<br>
<b>Subject:</b> Re: Decrypt SAML 2.0 Response</span><span style="color:black"><o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><span style="color:black"> <o:p></o:p></span></p>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;color:black">Do you know for certain that the IdP is sending you attribute statements? They are not required to be present.</span><span style="color:black"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;color:black"> </span><span style="color:black"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;color:black">Paul</span><span style="color:black"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;color:black"> </span><span style="color:black"><o:p></o:p></span></p>
</div>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="color:black">From: </span></b><span style="color:black">Asaf Peter <<a href="mailto:Asaf.Peter@exlibrisgroup.com">Asaf.Peter@exlibrisgroup.com</a>><br>
<b>Reply-To: </b>Shibboleth Dev <<a href="mailto:dev@shibboleth.net">dev@shibboleth.net</a>><br>
<b>Date: </b>Monday, November 26, 2012 7:34 AM<br>
<b>To: </b>Shibboleth Dev <<a href="mailto:dev@shibboleth.net">dev@shibboleth.net</a>><br>
<b>Subject: </b>Decrypt SAML 2.0 Response<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;color:black"> </span><span style="color:black"><o:p></o:p></span></p>
</div>
<div>
<div>
<p class="MsoNormal"><span style="color:#002060">Hi,</span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#002060"> </span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#002060">I get the attached XML response from Shibboleth IDP:</span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#002060"> </span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#002060">I am trying to decrypt it using the following code:</span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black"> <o:p></o:p></span></p>
<p class="MsoNormal" style="text-indent:.5in;text-autospace:none"><span style="font-size:10.0pt;font-family:Consolas;color:black"> </span><span style="font-family:Consolas;color:black">File keyStoreFile =
</span><b><span style="font-family:Consolas;color:#7F0055">new</span></b><span style="font-family:Consolas;color:black"> File(</span><span style="font-family:Consolas;color:#2A00FF">"C:/Users/MyUser/my-private-key.pfx"</span><span style="font-family:Consolas;color:black">);</span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:Consolas;color:black"> String certAlias =
</span><span style="font-family:Consolas;color:#2A00FF">"re-23d2gt1b-779r-39ez-1156-91b3f80eaee2"</span><span style="font-family:Consolas;color:black">;</span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:Consolas;color:black"> String password =
</span><span style="font-family:Consolas;color:#2A00FF">"my_password"</span><span style="font-family:Consolas;color:black">;</span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:Consolas;color:black"> KeyStore keyStore = KeyStore.<i>getInstance</i>(</span><span style="font-family:Consolas;color:#2A00FF">"PKCS12"</span><span style="font-family:Consolas;color:black">);</span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:Consolas;color:black"> keyStore.load(</span><b><span style="font-family:Consolas;color:#7F0055">new</span></b><span style="font-family:Consolas;color:black"> FileInputStream(keyStoreFile),
password.toCharArray());</span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:Consolas;color:black"> RSAPrivateKey privateKey = (RSAPrivateKey) keyStore.getKey(certAlias, password.toCharArray());</span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:Consolas;color:black"> BasicX509Credential decryptionCredential =
</span><b><span style="font-family:Consolas;color:#7F0055">new</span></b><span style="font-family:Consolas;color:black"> BasicX509Credential();</span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:Consolas;color:black"> decryptionCredential.setPrivateKey(privateKey);</span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:Consolas;color:black"> Decrypter decrypter =
</span><b><span style="font-family:Consolas;color:#7F0055">new</span></b><span style="font-family:Consolas;color:black"> Decrypter(</span><b><span style="font-family:Consolas;color:#7F0055">null</span></b><span style="font-family:Consolas;color:black">,
</span><b><span style="font-family:Consolas;color:#7F0055">new</span></b><span style="font-family:Consolas;color:black"> StaticKeyInfoCredentialResolver(decryptionCredential),
</span><b><span style="font-family:Consolas;color:#7F0055">new</span></b><span style="font-family:Consolas;color:black"> InlineEncryptedKeyResolver());</span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:Consolas;color:black"> Assertion decryptedAssertion;</span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:Consolas;color:black">
</span><b><span style="font-family:Consolas;color:#7F0055">try</span></b><span style="font-family:Consolas;color:black"> {</span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:Consolas;color:black"> decryptedAssertion = decrypter.decrypt(response.getEncryptedAssertions().get(0)); //
</span><b><span style="font-family:Consolas;color:red">SUCCESS!!!</span></b><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:Consolas;color:black"> }</span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black"> <o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#002060">The decryption seems to work now – no exception is thrown and I get the decryptedAssertion.</span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#002060">However, I cannot find the user id in the decryptedAssertion.
</span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#002060">The decryptedAssertion.getAttributeStatements() returns an empty list.
</span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#002060">Am I missing something? </span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#002060"> </span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#002060">Thanks,</span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#002060">Asaf</span><span style="color:black"><o:p></o:p></span></p>
</div>
</div>
</div>
</div>
</div>
</body>
</html>