<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">
<div>
<div style="font-family: Calibri, sans-serif; font-size: 14px; color: rgb(0, 0, 0);">
I was able to narrow down the problem and it seems it lies in the EncryptedAssertion. I am able to marshall signed and unsigned assertions, but after I encrypt both assertions, I get the following error with the encrypted assertion:</div>
<div style="font-family: Calibri, sans-serif; font-size: 14px; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, sans-serif; font-size: 14px; color: rgb(0, 0, 0);">
These are the steps I am following to create my Response with Encrypted Assertion</div>
<ol>
<li style="font-family: Calibri, sans-serif; font-size: 14px; color: rgb(0, 0, 0);">
Create Assertion (able to marshall)</li><li style="font-family: Calibri, sans-serif; font-size: 14px; color: rgb(0, 0, 0);">
Sign Assertion (able to marshall)</li><li style="font-family: Calibri, sans-serif; font-size: 14px; color: rgb(0, 0, 0);">
Validate Assertion signature</li><li><font color="#ff0000"><font face="Calibri,sans-serif">Encrypt Assertion (marshaling fails)</font></font></li></ol>
<div style="font-family: Calibri, sans-serif; font-size: 14px; color: rgb(0, 0, 0);">
Step 3 fails with the following exception: Caused by: org.opensaml.core.xml.io.MarshallingException: Unable to root namespaces of cached DOM element, {<a href="http://www.w3.org/2001/04/xmlenc#}EncryptionMethod">http://www.w3.org/2001/04/xmlenc#}EncryptionMethod</a></div>
<div style="font-family: Calibri, sans-serif; font-size: 14px; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, sans-serif; font-size: 14px; color: rgb(0, 0, 0);">
There might be missing something with my method that receives and Assertion and returns a EncryptedAssertion. I am currently using JDK 1.8 from Oracle on MacOS and I guess I am using jaxp that is internal to the JRE because the only dependencies on my POM are
OpenSAML dependencies.</div>
<div style="font-family: Calibri, sans-serif; font-size: 14px; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, sans-serif; font-size: 14px; color: rgb(0, 0, 0);">
I care share my project, it has a couple of classes and one unit test that I am validating the migration from V2 to V3.</div>
<div style="font-family: Calibri, sans-serif; font-size: 14px; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, sans-serif; font-size: 14px; color: rgb(0, 0, 0);">
Thank you</div>
<div style="font-family: Calibri, sans-serif; font-size: 14px; color: rgb(0, 0, 0);">
<div><span style="font-family: 'Calibri Light'; color: rgb(0, 73, 144);"></span></div>
</div>
</div>
<div style="font-family: Calibri, sans-serif; font-size: 14px; color: rgb(0, 0, 0);">
<br>
</div>
<span id="OLK_SRC_BODY_SECTION" style="font-family: Calibri, sans-serif; font-size: 14px; color: rgb(0, 0, 0);">
<div style="font-family:Calibri; font-size:11pt; text-align:left; color:black; BORDER-BOTTOM: medium none; BORDER-LEFT: medium none; PADDING-BOTTOM: 0in; PADDING-LEFT: 0in; PADDING-RIGHT: 0in; BORDER-TOP: #b5c4df 1pt solid; BORDER-RIGHT: medium none; PADDING-TOP: 3pt">
<span style="font-weight:bold">From: </span>dev <<a href="mailto:dev-bounces@shibboleth.net">dev-bounces@shibboleth.net</a>> on behalf of Brent Putman <<a href="mailto:putmanb@georgetown.edu">putmanb@georgetown.edu</a>><br>
<span style="font-weight:bold">Reply-To: </span>Shib Dev <<a href="mailto:dev@shibboleth.net">dev@shibboleth.net</a>><br>
<span style="font-weight:bold">Date: </span>Wednesday, April 26, 2017 at 7:12 PM<br>
<span style="font-weight:bold">To: </span>"<a href="mailto:dev@shibboleth.net">dev@shibboleth.net</a>" <<a href="mailto:dev@shibboleth.net">dev@shibboleth.net</a>><br>
<span style="font-weight:bold">Subject: </span>Re: OpenSAML V3: Problems while marshaling encrypted assertion<br>
</div>
<div><br>
</div>
<div>
<div text="#000000" bgcolor="#FFFFFF">
<p><br>
</p>
<br>
<div class="moz-cite-prefix">On 4/26/17 12:47 PM, Locatelli da Silva, Thiago wrote:<br>
</div>
<blockquote type="cite" cite="mid:D52647EC.D470%25thiago.locatellidasilva@transamerica.com">
<div>By any chance, does anyone know what I am doing wrong?</div>
<div><br>
</div>
<div><a href="https://urldefense.proofpoint.com/v2/url?u=http-3A__stackoverflow.com_questions_43636869_error-2Dexception-2Dwhile-2Dmarshalling-2Dsigned-2Dand-2Dencrypted-2Dresponse-2Dopensaml-2Dv3&d=DwMD-g&c=9g4MJkl2VjLjS6R4ei18BA&r=KFwt8mjPy_yYOL1zsYKnEeZFUYrLAC8JhxUYm-xzRVnN6LfAFPxkaK1E0ofPGXNB&m=JKRzQCebPibajqPFZUSAtqGoHMK4Xnd_533X0fndqig&s=q2ylKOxKkxJLslUiDhhIAIrg5dXCEZu8VhwY78afg6M&e=" moz-do-not-send="true">http://stackoverflow.com/questions/43636869/error-exception-while-marshalling-signed-and-encrypted-response-opensaml-v3</a></div>
<br>
</blockquote>
<br>
I can't see anything obviously wrong with what you are doing. I suspect that the issue might lie with what you are doing *before* the code you posted there, such as when/how you are encrypting the Assertion and then adding the EncryptedAssertion to the Response;
how those XMLObjects are all being constructed, and so on.<br>
<br>
I can state with certainty that it does in general work, as we do this very thing in the Shibboleth IdP. In case it's helpful, here is the OpenSAML profile action component which encrypts Assertions and adds them to the Response, which is used in the IdP for
this purpose:<br>
<br>
<a class="moz-txt-link-freetext" href="https://urldefense.proofpoint.com/v2/url?u=https-3A__git.shibboleth.net_view_-3Fp-3Djava-2Dopensaml.git-3Ba-3Dblob-3Bf-3Dopensaml-2Dsaml-2Dimpl_src_main_java_org_opensaml_saml_saml2_profile_impl_EncryptAssertions.java-3Bhb-3DHEAD&d=DwMD-g&c=9g4MJkl2VjLjS6R4ei18BA&r=KFwt8mjPy_yYOL1zsYKnEeZFUYrLAC8JhxUYm-xzRVnN6LfAFPxkaK1E0ofPGXNB&m=JKRzQCebPibajqPFZUSAtqGoHMK4Xnd_533X0fndqig&s=mzJxaOGPnCIRlETiKkEindfUOLJ1BRpgkLVlPmnEbNg&e=">https://git.shibboleth.net/view/?p=java-opensaml.git;a=blob;f=opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/profile/impl/EncryptAssertions.java;hb=HEAD</a><br>
<br>
It's possible you've got something in the wrong order? Or possibly you've hit some unknown bug in the OpenSAML code. It might also be an issue with the XML DOM/JAXP impl you're using. What Java platform/vendor/version are you on? Have you done anything special
around DOM processing config, like endorse a custom Xerces or anything like that? Or are you just using the JAXP impl that is internal to your JRE?<br>
</div>
</div>
</span><br>
<hr>
<font face="Arial" color="Gray" size="1"><br>
CONFIDENTIALITY NOTICE<br>
This transmission is intended for the sole use of the individual and/or entity to whom it is addressed, and may contain information and/or attachments that are privileged, confidential and exempt from disclosure under applicable law. If the reader of this transmission
is not the intended recipient, you are hereby notified that any disclosure, dissemination, distribution, duplication or the taking of any action in reliance on the contents of this transmission by someone other than the intended addressee or its designated
agent is strictly prohibited. If your receipt of this transmission is in error, please notify the sender by replying immediately to this transmission and destroying the transmission. For your protection, do not include Social Security numbers, passwords or
other non-public and personal information in your email. Thank you.<br>
</font>
</body>
</html>