<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">
<div>
<div style="color: rgb(0, 0, 0); font-family: Calibri, sans-serif; font-size: 14px;">
Brent, good morning.</div>
<div style="color: rgb(0, 0, 0); font-family: Calibri, sans-serif; font-size: 14px;">
<br>
</div>
<div style="color: rgb(0, 0, 0); font-family: Calibri, sans-serif; font-size: 14px;">
Here I am again,</div>
<div style="color: rgb(0, 0, 0); font-family: Calibri, sans-serif; font-size: 14px;">
<br>
</div>
<div style="color: rgb(0, 0, 0); font-family: Calibri, sans-serif; font-size: 14px;">
I found this old discussion from the list, <a href="http://shibboleth.1660669.n2.nabble.com/Error-on-signing-outbound-SAML-message-td7621620.html">http://shibboleth.1660669.n2.nabble.com/Error-on-signing-outbound-SAML-message-td7621620.html</a>, in which the
user is facing the same issue I am facing, even though I am programmatically signing and encrypting, the resulting exception is the same. At the end of the discussion Scott says something about xmlsec 2.x, and looking at my maven dependencies I see xmlsec
1.5.7, which is coming from this dependency</div>
<div style="color: rgb(0, 0, 0); font-family: Calibri, sans-serif; font-size: 14px;">
<br>
</div>
<div>
<p style="color: rgb(78, 145, 146); font-family: Monaco; font-size: 11px; margin: 0px; line-height: normal;">
<span style="color: #000000"><span class="Apple-tab-span" style="white-space:pre"></span></span><span style="color: #009193"><</span>dependency<span style="color: #009193">></span></p>
<p style="color: rgb(0, 0, 0); font-family: Monaco; font-size: 11px; margin: 0px; line-height: normal;">
<span class="Apple-tab-span" style="white-space:pre"></span><span style="color: #009193"><</span><span style="color: #4e9192">groupId</span><span style="color: #009193">></span>org.opensaml<span style="color: #009193"></</span><span style="color: #4e9192">groupId</span><span style="color: #009193">></span></p>
<p style="color: rgb(78, 145, 146); font-family: Monaco; font-size: 11px; margin: 0px; line-height: normal;">
<span style="color: #000000"><span class="Apple-tab-span" style="white-space:pre"></span></span><span style="color: #009193"><</span>artifactId<span style="color: #009193">></span><span style="text-decoration: underline ; color: #000000">xmltooling</span><span style="color: #009193"></</span>artifactId<span style="color: #009193">></span></p>
<p style="color: rgb(78, 145, 146); font-family: Monaco; font-size: 11px; margin: 0px; line-height: normal;">
<span style="color: #000000"><span class="Apple-tab-span" style="white-space:pre"></span></span><span style="color: #009193"><</span>version<span style="color: #009193">></span><span style="color: #000000">1.4.4</span><span style="color: #009193"></</span>version<span style="color: #009193">></span></p>
<p style="color: rgb(78, 145, 146); font-family: Monaco; font-size: 11px; margin: 0px; line-height: normal;">
<span style="color: #000000"><span class="Apple-tab-span" style="white-space:pre"></span></span><span style="color: #009193"></</span>dependency<span style="color: #009193">></span></p>
<p style="color: rgb(78, 145, 146); font-family: Monaco; font-size: 11px; margin: 0px; line-height: normal;">
<span style="color: #009193"><br>
</span></p>
<p style="margin: 0px; line-height: normal;"><font face="Calibri">I added an exclusion to this dependency so Maven could use the version declared by opensaml-security-api, which is xmlsec 2.0.5. By doing this my problem was fixed. I am now able to encrypt my
signed assertions and marshall them.</font></p>
<p style="margin: 0px; line-height: normal;"><font face="Calibri"><br>
</font></p>
<p style="margin: 0px; line-height: normal;"><font face="Calibri">I am only running into a validation issue with my response, but I think the way I am doing is not valid anymore for OpenSAML V3.</font></p>
<p style="margin: 0px; line-height: normal;"><font face="Calibri"><br>
</font></p>
<p style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco;">
<span style="color: #931a68">for</span>(String <span style="color: #7e504f">
suiteId</span> : Arrays.asList(</p>
<p style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco; color: rgb(57, 51, 255);">
<span style="color: #000000"> </span>"saml2-core-schema-validator"<span style="color: #000000">,</span></p>
<p style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco; color: rgb(57, 51, 255);">
<span style="color: #000000"> </span>"saml2-core-spec-validator"<span style="color: #000000">,</span></p>
<p style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco; color: rgb(57, 51, 255);">
<span style="color: #000000"> </span>"saml2-metadata-schema-validator"<span style="color: #000000">, </span></p>
<p style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco; color: rgb(57, 51, 255);">
<span style="color: #000000"> </span>"saml2-metadata-spec-validator"<span style="color: #000000">)) {</span></p>
<p style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco;">
ValidatorSuite <span style="color: #7e504f">validatorSuide</span> = <span style="color: #931a68">
new</span> ValidatorSuite(<span style="color: #7e504f">suiteId</span>);</p>
<p style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco;">
<span style="color: #7e504f">validatorSuide</span>.validate((XMLObject)
<span style="color: #7e504f">response</span>.getDOM());</p>
<p style="margin: 0px; line-height: normal;"></p>
<p style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco;">
}</p>
<p style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco;">
<br>
</p>
<p style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco;">
java.lang.ClassCastException: com.sun.org.apache.xerces.internal.dom.ElementNSImpl cannot be cast to org.opensaml.xml.XMLObject</p>
<p style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco;">
<br>
</p>
<p style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco;">
But this is something I have to look at.</p>
<p style="margin: 0px; line-height: normal;"><font face="Calibri"><br>
</font></p>
<p style="margin: 0px; line-height: normal;"><font face="Calibri">Thank you Bren for your help and suggestions.</font></p>
</div>
<div>
<div><font face="Calibri"></font></div>
</div>
</div>
<div style="color: rgb(0, 0, 0); font-family: Calibri, sans-serif; font-size: 14px;">
<br>
</div>
<span id="OLK_SRC_BODY_SECTION" style="color: rgb(0, 0, 0); font-family: Calibri, sans-serif; font-size: 14px;">
<div style="font-family:Calibri; font-size:11pt; text-align:left; color:black; BORDER-BOTTOM: medium none; BORDER-LEFT: medium none; PADDING-BOTTOM: 0in; PADDING-LEFT: 0in; PADDING-RIGHT: 0in; BORDER-TOP: #b5c4df 1pt solid; BORDER-RIGHT: medium none; PADDING-TOP: 3pt">
<span style="font-weight:bold">From: </span>Brent Putman <<a href="mailto:putmanb@georgetown.edu">putmanb@georgetown.edu</a>><br>
<span style="font-weight:bold">Date: </span>Thursday, April 27, 2017 at 6:11 PM<br>
<span style="font-weight:bold">To: </span>Shib Dev <<a href="mailto:dev@shibboleth.net">dev@shibboleth.net</a>>, "Locatelli da Silva, Thiago" <<a href="mailto:thiago.locatellidasilva@transamerica.com">thiago.locatellidasilva@transamerica.com</a>><br>
<span style="font-weight:bold">Subject: </span>Re: OpenSAML V3: Problems while marshaling encrypted assertion<br>
</div>
<div><br>
</div>
<div>
<div text="#000000" bgcolor="#FFFFFF">
<p><br>
</p>
<br>
<div class="moz-cite-prefix">On 4/26/17 9:39 PM, Locatelli da Silva, Thiago wrote:<br>
</div>
<blockquote type="cite" cite="mid:D526BC12.D6C3%25thiago.locatellidasilva@transamerica.com">
<div>
<div>This is how I am signing the assertion:</div>
<div><br>
</div>
<div>
<p style="margin: 0px; font-size: 11px; line-height: normal;
font-family: Monaco;">
<span style="color: #931a68">private</span> Assertion createSignedAssertion()
<span style="color: #931a68">throws</span> SamlException {</p>
<p style="margin: 0px; font-size: 11px; line-height: normal;
font-family: Monaco;">
<span style="color: #931a68">try</span> {</p>
<p style="margin: 0px; font-size: 11px; line-height: normal;
font-family: Monaco; min-height: 15px;">
</p>
<p style="margin: 0px; font-size: 11px; line-height: normal;
font-family: Monaco;">
Signature <span style="color: #7e504f">signature</span> = createSignature();</p>
<p style="margin: 0px; font-size: 11px; line-height: normal;
font-family: Monaco;">
Assertion <span style="color: #7e504f">assertion</span> = createAssertion();</p>
<p style="margin: 0px; font-size: 11px; line-height: normal;
font-family: Monaco;">
<span style="color: #7e504f">assertion</span>.setSignature(<span style="color: #7e504f">signature</span>);</p>
<p style="margin: 0px; font-size: 11px; line-height: normal;
font-family: Monaco; min-height: 15px;">
<br>
</p>
<p style="margin: 0px; font-size: 11px; line-height: normal;
font-family: Monaco;">
MarshallerFactory <span style="color: #7e504f">marshallerFactory</span> = XMLObjectProviderRegistrySupport.getMarshallerFactory();</p>
<p style="margin: 0px; font-size: 11px; line-height: normal;
font-family: Monaco;">
<span style="color: #7e504f">marshallerFactory</span>.getMarshaller(<span style="color: #7e504f">assertion</span>).marshall(<span style="color: #7e504f">assertion</span>);</p>
<p style="margin: 0px; font-size: 11px; line-height: normal;
font-family: Monaco;">
Signer.signObject(<span style="color: #7e504f">signature</span>);</p>
<p style="margin: 0px; font-size: 11px; line-height: normal;
font-family: Monaco; min-height: 15px;">
<br>
</p>
<p style="margin: 0px; font-size: 11px; line-height: normal;
font-family: Monaco;">
UnmarshallerFactory <span style="color:
#7e504f">unmarshallerFactory</span> = XMLObjectProviderRegistrySupport.getUnmarshallerFactory();</p>
<p style="margin: 0px; font-size: 11px; line-height: normal;
font-family: Monaco;">
Assertion <span style="color: #7e504f">signedAssertion</span> = (Assertion)
<span style="color: #7e504f">unmarshallerFactory</span>.getUnmarshaller(<span style="color: #7e504f">assertion</span>.getDOM()).unmarshall(<span style="color: #7e504f">assertion</span>.getDOM());</p>
<p style="margin: 0px; font-size: 11px; line-height: normal;
font-family: Monaco; min-height: 15px;">
<br>
</p>
<p style="margin: 0px; font-size: 11px; line-height: normal;
font-family: Monaco; color: rgb(126, 80, 79);">
<span style="color: #000000"> </span><span style="color: #931a68">return</span><span style="color:
#000000"></span>signedAssertion<span style="color: #000000">;</span></p>
</div>
</div>
</blockquote>
<br>
The only thing that looks odd or unusual in your code so far is what you are doing above to unmarshall a new Assertion object after you've signed the input Assertion. You don't in general have to do that. You just sign it as you are doing and then make use
of the existing Assertion instance. It's already signed. I don't know off-hand if what you are doing could be screwing up the XML namespaces per the exception, but it could be, as it certainly is related to the DOM instances that are cached on the objects.<br>
<br>
I would suggest to try just commenting out those two unmarshalling lines above and just return the 'assertion' instance.<br>
<br>
</div>
</div>
</span><br>
<hr>
<font face="Arial" color="Gray" size="1"><br>
CONFIDENTIALITY NOTICE<br>
This transmission is intended for the sole use of the individual and/or entity to whom it is addressed, and may contain information and/or attachments that are privileged, confidential and exempt from disclosure under applicable law. If the reader of this transmission
is not the intended recipient, you are hereby notified that any disclosure, dissemination, distribution, duplication or the taking of any action in reliance on the contents of this transmission by someone other than the intended addressee or its designated
agent is strictly prohibited. If your receipt of this transmission is in error, please notify the sender by replying immediately to this transmission and destroying the transmission. For your protection, do not include Social Security numbers, passwords or
other non-public and personal information in your email. Thank you.<br>
</font>
</body>
</html>