<html><body><div style="color:#000; background-color:#fff; font-family:HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;font-size:10pt"><div class="" style="">Hi,</div><div class="" style=""><br class="" style=""></div><div style="color: rgb(0, 0, 0); font-size: 13px; font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; background-color: transparent; font-style: normal" class="">I am writing client side of an authentication service, where I get encrypted and signed SAML response from the server process.</div><div style="color: rgb(0, 0, 0); font-size: 13px; font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; background-color: transparent; font-style: normal" class="">I am confused about the right way to decrypt an encrypted response (precisely, a signed response with encrypted assertion in it). I am writing the pseudo-code which I have (mainly from
the saml-2.5.3-src/samltest/encryption/EncryptedAssertionTest.h) : </div><div style="color: rgb(0, 0, 0); font-size: 13px; font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; background-color: transparent; font-style: normal" class=""><br class="" style=""></div><div style="color: rgb(0, 0, 0); font-size: 13px; font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; background-color: transparent; font-style: normal" class="">========================================</div><div style="color: rgb(0, 0, 0); font-size: 13px; font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; background-color: transparent; font-style: normal" class=""><br class="" style=""></div><div style="background-color: transparent" class=""><span class="" style="white-space:pre"> </span>/* get the credential resolver */</div><div style="background-color:
transparent" class=""><span class="" style="white-space:pre"> </span>credentialresolver* c_resolver = null;</div><div style="background-color: transparent" class=""><span class="" style="white-space:pre"> </span>std::string config = keystore_path + "filesystemcredentialresolver.xml";<span class="" style="white-space:pre"> </span>// has client <span style="background-color: transparent; font-size: 10pt" class="">private/public key</span></div><div style="background-color: transparent" class=""><span class="" style="white-space:pre"> </span>std::ifstream in(config.c_str());</div><div style="background-color: transparent" class=""><span class="" style="white-space:pre"> </span>domdocument* doc = xmltoolingconfig::getconfig().getparser().parse(in);</div><div style="background-color: transparent" class=""><span class="" style="white-space:pre"> </span>xercesjanitor<domdocument> janitor(doc);</div><div style="background-color: transparent"
class=""><span class="" style="white-space:pre"> </span>c_resolver = xmltoolingconfig::getconfig().credentialresolvermanager.</div><div style="background-color: transparent" class=""><span class="" style="white-space:pre"> </span>newplugin(filesystem_credential_resolver,doc->getdocumentelement());</div><div style="background-color: transparent" class=""><span class="" style="white-space:pre"> </span>in.close();</div><div style="background-color: transparent" class=""><br class="" style=""></div><div style="background-color: transparent" class=""><span class="" style="white-space:pre"> </span>/* get the meta-data provider details */</div><div style="background-color: transparent" class=""> std::string m_config = keystore_path + "metadataproviderconfig.xml";<span class="" style="white-space:pre"> <span class="" style="white-space:pre"> </span> </span>// tells the path of <span style="background-color: transparent;
font-size: 10pt" class="">actual metadata file</span></div><div style="background-color: transparent" class=""> std::ifstream m_in(m_config.c_str());</div><div style="background-color: transparent" class=""> domdocument* m_doc = xmltoolingconfig::getconfig().getparser().parse(m_in);</div><div style="background-color: transparent" class=""><span style="white-space: pre" class=""> </span>xercesjanitor<domdocument> m_janitor(m_doc);</div><div style="background-color: transparent" class=""> auto_ptr_xmlch md_path("path");</div><div style="background-color: transparent" class=""> std::string s = keystore_path + "metadata.xml";<span class="" style="white-space:pre"> </span>// same file as <span style="background-color: transparent; font-size: 10pt" class="">example-metadata.xml in samltest/data</span></div><div style="background-color: transparent" class="">
auto_ptr_xmlch file(s.c_str());</div><div style="background-color: transparent" class=""> (m_doc->getdocumentelement())->setattributens(null, md_path.get(), file.get());</div><div style="background-color: transparent" class=""> opensaml::saml2md::metadataprovider *m_metadata = <span style="background-color: transparent; font-size: 10pt" class=""> </span><span class="" style="background-color: transparent; font-size: 10pt; white-space: pre"> </span><span style="background-color: transparent; font-size: 10pt" class="">opensaml::samlconfig::getconfig().metadataprovidermanager.newplugin(</span></div><div style="background-color: transparent" class=""> xml_metadata_provider,m_doc->getdocumentelement());</div><div style="background-color: transparent" class=""> m_metadata->init();</div><div style="background-color: transparent" class=""> locker
mlocker(m_metadata);</div><div style="background-color: transparent" class=""><br class="" style=""></div><div style="background-color: transparent; color: rgb(0, 0, 0); font-size: 13px; font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-style: normal" class=""> /* create metadata provider */</div><div style="background-color: transparent" class=""> opensaml::saml2md::metadataprovider::criteria mc("https://sp.example.org/", &opensaml::saml2md::<span style="background-color: transparent; font-size: 10pt" class="">spssodescriptor::element_qname, samlconstants::saml20p_ns);</span></div><div style="background-color: transparent" class=""> std::pair<const opensaml::saml2md::entitydescriptor*,const opensaml::saml2md::roledescriptor*> sp = </div><div style="background-color: transparent" class="">m_metadata->getentitydescriptor(mc);</div><div
style="background-color: transparent" class=""><br class="" style=""></div><div style="background-color: transparent; color: rgb(0, 0, 0); font-size: 13px; font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-style: normal" class=""> /* get encrypted assertion from response (available to this function) */</div><div style="background-color: transparent" class=""> encryptedassertion *ea = null;</div><div style="background-color: transparent" class=""><span class="" style="white-space:pre"> </span>if ((response->getencryptedassertions()).size() > 0) {</div><div style="background-color: transparent" class=""><span class="" style="white-space:pre"> </span>/* get the first encrypted assertion */</div><div style="background-color: transparent" class=""><span class="" style="white-space:pre"> <span class="" style="white-space:pre"> </span> </span>ea =
dynamic_cast<encryptedassertion*>((response->getencryptedassertions()).at(0));</div><div style="background-color: transparent" class=""><span style="white-space: pre" class=""> </span>}</div><div style="background-color: transparent" class=""><span class="" style="white-space:pre"> </span>std::auto_ptr<opensaml::saml2::assertion> assertion2(dynamic_cast<opensaml::saml2::assertion*>(ea-></div><div style="background-color: transparent" class="">decrypt(*c_resolver, sp.first->getentityid())));</div><div style="background-color: transparent" class=""><br class="" style=""></div><div style="background-color: transparent; color: rgb(0, 0, 0); font-size: 13px; font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-style: normal" class="">=================================</div><div style="background-color: transparent; color: rgb(0, 0, 0); font-size: 13px; font-family:
HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-style: normal" class=""><br class="" style=""></div><div style="background-color: transparent; color: rgb(0, 0, 0); font-size: 13px; font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-style: normal" class="">I have posted the same code in pastebin (http://pastebin.com/VvLnDxGv).</div><div style="background-color: transparent; color: rgb(0, 0, 0); font-size: 13px; font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-style: normal" class="">Is it the right way to do it or this code is too convoluted for what it is supposed to do (extracting decrypted assertion from encrypted assertion, which is in a SAML response). This code dumps core on the last decrypt step </div><div style="background-color: transparent; color: rgb(0, 0, 0); font-size: 13px; font-family: HelveticaNeue,
'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-style: normal" class=""><span style="background-color: transparent; font-size: 10pt" class=""><span class="Apple-tab-span" style="white-space:pre"> </span>ea-></span><span style="background-color: transparent; font-size: 10pt;">decrypt(*c_resolver, sp.first->getentityid())</span></div><div style="background-color: transparent; color: rgb(0, 0, 0); font-size: 13px; font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-style: normal" class=""><br class="" style=""></div><div style="background-color: transparent; color: rgb(0, 0, 0); font-size: 13px; font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-style: normal;" class="">Please advise.</div><div style="background-color: transparent; color: rgb(0, 0, 0); font-size: 13px; font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial,
'Lucida Grande', sans-serif; font-style: normal;" class=""><br></div><div style="background-color: transparent; color: rgb(0, 0, 0); font-size: 13px; font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-style: normal;" class="">Thanks,</div><div style="background-color: transparent; color: rgb(0, 0, 0); font-size: 13px; font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-style: normal;" class="">Akshay</div></div></body></html>