<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; color: rgb(0, 0, 0); font-size: 14px; font-family: Calibri, sans-serif;">
<div>
<div>Hi Brent, thanks for you reply. First I was using V2 so I followed the book to migrate from V2 to V3.</div>
<div><br>
</div>
<div>This is how I am signing the assertion:</div>
<div><br>
</div>
<div>
<p style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco;">
<span style="color: #931a68">private</span> Assertion createSignedAssertion()
<span style="color: #931a68">throws</span> SamlException {</p>
<p style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco;">
<span style="color: #931a68">try</span> {</p>
<p style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco; min-height: 15px;">
</p>
<p style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco;">
Signature <span style="color: #7e504f">signature</span> = createSignature();</p>
<p style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco;">
Assertion <span style="color: #7e504f">assertion</span> = createAssertion();</p>
<p style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco;">
<span style="color: #7e504f">assertion</span>.setSignature(<span style="color: #7e504f">signature</span>);</p>
<p style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco; min-height: 15px;">
<br>
</p>
<p style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco;">
MarshallerFactory <span style="color: #7e504f">marshallerFactory</span> = XMLObjectProviderRegistrySupport.getMarshallerFactory();</p>
<p style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco;">
<span style="color: #7e504f">marshallerFactory</span>.getMarshaller(<span style="color: #7e504f">assertion</span>).marshall(<span style="color: #7e504f">assertion</span>);</p>
<p style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco;">
Signer.signObject(<span style="color: #7e504f">signature</span>);</p>
<p style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco; min-height: 15px;">
<br>
</p>
<p style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco;">
UnmarshallerFactory <span style="color: #7e504f">unmarshallerFactory</span> = XMLObjectProviderRegistrySupport.getUnmarshallerFactory();</p>
<p style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco;">
Assertion <span style="color: #7e504f">signedAssertion</span> = (Assertion)
<span style="color: #7e504f">unmarshallerFactory</span>.getUnmarshaller(<span style="color: #7e504f">assertion</span>.getDOM()).unmarshall(<span style="color: #7e504f">assertion</span>.getDOM());</p>
<p style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco; min-height: 15px;">
<br>
</p>
<p style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco; color: rgb(126, 80, 79);">
<span style="color: #000000"> </span><span style="color: #931a68">return</span><span style="color: #000000">
</span>signedAssertion<span style="color: #000000">;</span></p>
<p style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco;">
} <span style="color: #931a68">catch</span> (Exception <span style="color: #7e504f">
e</span>) {</p>
<p style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco;">
<span style="color: #931a68">throw</span> <span style="color: #931a68">
new</span> SamlException(<span style="color: #7e504f">e</span>);</p>
<p style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco;">
}</p>
<p style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco;">
}<span class="Apple-tab-span" style="white-space:pre"> </span></p>
<p style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco;">
<br>
</p>
<p style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco;">
This is how I am creating my signature</p>
<p style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco;">
<br>
</p>
<p style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco;">
<span class="Apple-tab-span" style="white-space:pre"></span><span style="color: #931a68">private</span> Signature createSignature()
<span style="color: #931a68">throws</span> SamlException {</p>
<p style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco; color: rgb(3, 38, 204);">
<span style="color: #000000"><span class="Apple-tab-span" style="white-space:pre"></span></span><span style="color: #931a68">if</span><span style="color: #000000"> (</span><span style="color: #931a68">this</span><span style="color: #000000">.</span>signingCertificate<span style="color: #000000">
!= </span><span style="color: #931a68">null</span><span style="color: #000000"> &&
</span><span style="color: #931a68">this</span><span style="color: #000000">.</span>signingPrivateKey<span style="color: #000000"> !=
</span><span style="color: #931a68">null</span><span style="color: #000000">) {</span></p>
<p style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco;">
<span class="Apple-tab-span" style="white-space:pre"></span>Signature <span style="color: #7e504f">
signature</span> = OpenSAMLUtils.buildSAMLObject(Signature.<span style="color: #931a68">class</span>);</p>
<p style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco;">
<span class="Apple-tab-span" style="white-space:pre"></span><span style="color: #7e504f">signature</span>.setSigningCredential(<span style="color: #931a68">new</span> BasicX509Credential((X509Certificate)
<span style="color: #0326cc">signingCertificate</span>, <span style="color: #0326cc">
signingPrivateKey</span>));</p>
<p style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco;">
<span class="Apple-tab-span" style="white-space:pre"></span><span style="color: #7e504f">signature</span>.setSignatureAlgorithm(SignatureConstants.<span style="color: #0326cc">ALGO_ID_SIGNATURE_RSA_SHA1</span>);</p>
<p style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco;">
<span class="Apple-tab-span" style="white-space:pre"></span><span style="color: #7e504f">signature</span>.setCanonicalizationAlgorithm(SignatureConstants.<span style="color: #0326cc">ALGO_ID_C14N_WITH_COMMENTS</span>);</p>
<p style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco; color: rgb(126, 80, 79);">
<span style="color: #000000"><span class="Apple-tab-span" style="white-space:pre"></span></span><span style="color: #931a68">return</span><span style="color: #000000">
</span>signature<span style="color: #000000">;</span></p>
<p style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco;">
<span class="Apple-tab-span" style="white-space:pre"></span>}<span class="Apple-tab-span" style="white-space:pre">
</span></p>
<p style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco; min-height: 15px;">
<br>
</p>
<p style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco; color: rgb(147, 26, 104);">
<span style="color: #000000"><span class="Apple-tab-span" style="white-space:pre"></span></span>return<span style="color: #000000">
</span>null<span style="color: #000000">;</span></p>
<p style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco;">
</p>
<p style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco;">
<span class="Apple-tab-span" style="white-space:pre"></span>}</p>
<p style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco;">
<br>
</p>
<p style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco;">
It does work because I am able to print the response with the signed assertion, and this is how I am creating my Response object</p>
<p style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco;">
<br>
</p>
<p style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco;">
<span class="Apple-tab-span" style="white-space:pre"></span><span style="color: #931a68">private</span> Response createResponse(Assertion
<span style="color: #7e504f">assertion</span>, EncryptedAssertion <span style="color: #7e504f">
encryptedAssertion</span>) {</p>
<p style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco;">
<span class="Apple-tab-span" style="white-space:pre"></span>Response <span style="color: #7e504f">
response</span> = OpenSAMLUtils.buildSAMLObject(Response.<span style="color: #931a68">class</span>);</p>
<p style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco;">
<span class="Apple-tab-span" style="white-space:pre"></span><span style="color: #7e504f">response</span>.setID(<span style="color: #931a68">this</span>.<span style="color: #0326cc">responseId</span>);</p>
<p style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco;">
<span class="Apple-tab-span" style="white-space:pre"></span><span style="color: #7e504f">response</span>.setIssueInstant(<span style="color: #931a68">this</span>.<span style="color: #0326cc">issueInstant</span>);</p>
<p style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco;">
<span class="Apple-tab-span" style="white-space:pre"></span><span style="color: #7e504f">response</span>.setVersion(SAMLVersion.<span style="color: #0326cc">VERSION_20</span>);</p>
<p style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco;">
<span class="Apple-tab-span" style="white-space:pre"></span><span style="color: #7e504f">response</span>.setIssuer(createIssuer(<span style="color: #0326cc">responseIssuer</span>));</p>
<p style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco;">
<span class="Apple-tab-span" style="white-space:pre"></span><span style="color: #7e504f">response</span>.setStatus(createStatus());</p>
<p style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco; color: rgb(3, 38, 204);">
<span style="color: #000000"><span class="Apple-tab-span" style="white-space:pre"></span></span><span style="color: #931a68">if</span><span style="color: #000000">(</span><span style="color: #931a68">this</span><span style="color: #000000">.</span>responseDestination<span style="color: #000000">
!= </span><span style="color: #931a68">null</span><span style="color: #000000">)
</span><span style="color: #7e504f">response</span><span style="color: #000000">.setDestination(</span><span style="color: #931a68">this</span><span style="color: #000000">.</span>responseDestination<span style="color: #000000">);</span></p>
<p style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco;">
<span class="Apple-tab-span" style="white-space:pre"></span><span style="color: #931a68">if</span>(<span style="color: #7e504f">assertion</span> !=
<span style="color: #931a68">null</span>) <span style="color: #7e504f">response</span>.getAssertions().add(<span style="color: #7e504f">assertion</span>);</p>
<p style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco; color: rgb(126, 80, 79);">
<span style="color: #000000"><span class="Apple-tab-span" style="white-space:pre"></span></span><span style="color: #931a68">if</span><span style="color: #000000">(</span>encryptedAssertion<span style="color: #000000"> !=
</span><span style="color: #931a68">null</span><span style="color: #000000">) </span>
response<span style="color: #000000">.getEncryptedAssertions().add(</span>encryptedAssertion<span style="color: #000000">);</span></p>
<p style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco; color: rgb(126, 80, 79);">
<span style="color: #000000"><span class="Apple-tab-span" style="white-space:pre"></span></span><span style="color: #931a68">return</span><span style="color: #000000">
</span>response<span style="color: #000000">;</span></p>
<p style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco;">
</p>
<p style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco;">
<span class="Apple-tab-span" style="white-space:pre"></span>}</p>
<div><br>
</div>
<div>The OpenSAMLUtils.buildSAMLObject is the code provided in the OpenSAML V3 book.</div>
<div><br>
</div>
<div>
<p style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco;">
<span style="color: #931a68">public</span> <span style="color: #931a68">static</span> <T> T buildSAMLObject(<span style="color: #931a68">final</span> Class<T>
<span style="color: #7e504f">clazz</span>) {</p>
<p style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco;">
T <span style="color: #7e504f">object</span> = <span style="color: #931a68">
null</span>;</p>
<p style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco;">
<span style="color: #931a68">try</span> {</p>
<p style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco;">
XMLObjectBuilderFactory <span style="color: #7e504f">builderFactory</span> = XMLObjectProviderRegistrySupport.getBuilderFactory();</p>
<p style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco;">
QName <span style="color: #7e504f">defaultElementName</span> = (QName)
<span style="color: #7e504f">clazz</span>.getDeclaredField(<span style="color: #3933ff">"DEFAULT_ELEMENT_NAME"</span>).get(<span style="color: #931a68">null</span>);</p>
<p style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco; color: rgb(126, 80, 79);">
<span style="color: #000000"> </span>object<span style="color: #000000"> =
</span><span style="text-decoration: underline ; color: #000000">(T) </span><span style="text-decoration: underline">builderFactory</span><span style="text-decoration: underline ; color: #000000">.getBuilder(</span><span style="text-decoration: underline">defaultElementName</span><span style="text-decoration: underline ; color: #000000">).buildObject(</span><span style="text-decoration: underline">defaultElementName</span><span style="text-decoration: underline ; color: #000000">)</span><span style="color: #000000">;</span></p>
<p style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco;">
} <span style="color: #931a68">catch</span> (IllegalAccessException <span style="color: #7e504f">
e</span>) {</p>
<p style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco;">
<span style="color: #931a68">throw</span> <span style="color: #931a68">
new</span> IllegalArgumentException(<span style="color: #3933ff">"Could not create SAML object"</span>);</p>
<p style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco;">
} <span style="color: #931a68">catch</span> (NoSuchFieldException <span style="color: #7e504f">
e</span>) {</p>
<p style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco;">
<span style="color: #931a68">throw</span> <span style="color: #931a68">
new</span> IllegalArgumentException(<span style="color: #3933ff">"Could not create SAML object"</span>);</p>
<p style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco;">
}</p>
<p style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco; min-height: 15px;">
<br>
</p>
<p style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco;">
<span style="color: #931a68">return</span> <span style="color: #7e504f">object</span>;</p>
<p style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco;">
}</p>
</div>
<div><br>
</div>
<div>This is my full class: <a href="https://hastebin.com/otibeqocap.java">https://hastebin.com/otibeqocap.java</a></div>
<div><br>
</div>
<div><u>Thank you</u></div>
<p style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco;">
<br>
</p>
<p style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco;">
<br>
</p>
</div>
<div><br>
</div>
</div>
<span id="OLK_SRC_BODY_SECTION">
<div style="font-family:Calibri; font-size:11pt; text-align:left; color:black; BORDER-BOTTOM: medium none; BORDER-LEFT: medium none; PADDING-BOTTOM: 0in; PADDING-LEFT: 0in; PADDING-RIGHT: 0in; BORDER-TOP: #b5c4df 1pt solid; BORDER-RIGHT: medium none; PADDING-TOP: 3pt">
<span style="font-weight:bold">From: </span>dev <<a href="mailto:dev-bounces@shibboleth.net">dev-bounces@shibboleth.net</a>> on behalf of Brent Putman <<a href="mailto:putmanb@georgetown.edu">putmanb@georgetown.edu</a>><br>
<span style="font-weight:bold">Reply-To: </span>Shib Dev <<a href="mailto:dev@shibboleth.net">dev@shibboleth.net</a>><br>
<span style="font-weight:bold">Date: </span>Wednesday, April 26, 2017 at 7:12 PM<br>
<span style="font-weight:bold">To: </span>"<a href="mailto:dev@shibboleth.net">dev@shibboleth.net</a>" <<a href="mailto:dev@shibboleth.net">dev@shibboleth.net</a>><br>
<span style="font-weight:bold">Subject: </span>Re: OpenSAML V3: Problems while marshaling encrypted assertion<br>
</div>
<div><br>
</div>
<div>
<div text="#000000" bgcolor="#FFFFFF">
<p><br>
</p>
<br>
<div class="moz-cite-prefix">On 4/26/17 12:47 PM, Locatelli da Silva, Thiago wrote:<br>
</div>
<blockquote type="cite" cite="mid:D52647EC.D470%25thiago.locatellidasilva@transamerica.com">
<div>By any chance, does anyone know what I am doing wrong?</div>
<div><br>
</div>
<div><a href="https://urldefense.proofpoint.com/v2/url?u=http-3A__stackoverflow.com_questions_43636869_error-2Dexception-2Dwhile-2Dmarshalling-2Dsigned-2Dand-2Dencrypted-2Dresponse-2Dopensaml-2Dv3&d=DwMD-g&c=9g4MJkl2VjLjS6R4ei18BA&r=KFwt8mjPy_yYOL1zsYKnEeZFUYrLAC8JhxUYm-xzRVnN6LfAFPxkaK1E0ofPGXNB&m=JKRzQCebPibajqPFZUSAtqGoHMK4Xnd_533X0fndqig&s=q2ylKOxKkxJLslUiDhhIAIrg5dXCEZu8VhwY78afg6M&e=" moz-do-not-send="true">http://stackoverflow.com/questions/43636869/error-exception-while-marshalling-signed-and-encrypted-response-opensaml-v3</a></div>
<br>
</blockquote>
<br>
I can't see anything obviously wrong with what you are doing. I suspect that the issue might lie with what you are doing *before* the code you posted there, such as when/how you are encrypting the Assertion and then adding the EncryptedAssertion to the Response;
how those XMLObjects are all being constructed, and so on.<br>
<br>
I can state with certainty that it does in general work, as we do this very thing in the Shibboleth IdP. In case it's helpful, here is the OpenSAML profile action component which encrypts Assertions and adds them to the Response, which is used in the IdP for
this purpose:<br>
<br>
<a class="moz-txt-link-freetext" href="https://urldefense.proofpoint.com/v2/url?u=https-3A__git.shibboleth.net_view_-3Fp-3Djava-2Dopensaml.git-3Ba-3Dblob-3Bf-3Dopensaml-2Dsaml-2Dimpl_src_main_java_org_opensaml_saml_saml2_profile_impl_EncryptAssertions.java-3Bhb-3DHEAD&d=DwMD-g&c=9g4MJkl2VjLjS6R4ei18BA&r=KFwt8mjPy_yYOL1zsYKnEeZFUYrLAC8JhxUYm-xzRVnN6LfAFPxkaK1E0ofPGXNB&m=JKRzQCebPibajqPFZUSAtqGoHMK4Xnd_533X0fndqig&s=mzJxaOGPnCIRlETiKkEindfUOLJ1BRpgkLVlPmnEbNg&e=">https://git.shibboleth.net/view/?p=java-opensaml.git;a=blob;f=opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/profile/impl/EncryptAssertions.java;hb=HEAD</a><br>
<br>
It's possible you've got something in the wrong order? Or possibly you've hit some unknown bug in the OpenSAML code. It might also be an issue with the XML DOM/JAXP impl you're using. What Java platform/vendor/version are you on? Have you done anything special
around DOM processing config, like endorse a custom Xerces or anything like that? Or are you just using the JAXP impl that is internal to your JRE?<br>
</div>
</div>
</span><br>
<hr>
<font face="Arial" color="Gray" size="1"><br>
CONFIDENTIALITY NOTICE<br>
This transmission is intended for the sole use of the individual and/or entity to whom it is addressed, and may contain information and/or attachments that are privileged, confidential and exempt from disclosure under applicable law. If the reader of this transmission
is not the intended recipient, you are hereby notified that any disclosure, dissemination, distribution, duplication or the taking of any action in reliance on the contents of this transmission by someone other than the intended addressee or its designated
agent is strictly prohibited. If your receipt of this transmission is in error, please notify the sender by replying immediately to this transmission and destroying the transmission. For your protection, do not include Social Security numbers, passwords or
other non-public and personal information in your email. Thank you.<br>
</font>
</body>
</html>