<div dir="ltr"><div>Hi Brent,</div><div><br></div><div>As you said I figured out that I was doing to much with the two decrypters during the process of looking after some code examples and cleaned up the process iin the way you've mentioned. But the thing is still the error persists. And I've debugged to see whats going on internally and I found that at class net.shibboleth.utilities.java.support.xml.NameSupport on the code snippet :</div><div><br></div><div><pre style="background-color:rgb(43,43,43);color:rgb(169,183,198);font-family:"DejaVu Sans Mono";font-size:9pt">namespaceURI = <span style="font-style:italic">lookupNamespaceURI</span>(upperNamespaceSearchBound<span style="color:rgb(204,120,50)">, null, </span>namespacePrefix)<span style="color:rgb(204,120,50)">;<br></span><span style="color:rgb(204,120,50)">if </span>(namespaceURI != <span style="color:rgb(204,120,50)">null</span>) {<br> <span style="color:rgb(128,128,128)">// Namespace resolved outside the subtree where namespaces must be declared so declare the namespace<br></span><span style="color:rgb(128,128,128)"> // on this element (within the subtree).<br></span><span style="color:rgb(128,128,128)"> </span><span style="font-style:italic">appendNamespaceDeclaration</span>(domElement<span style="color:rgb(204,120,50)">, </span>namespaceURI<span style="color:rgb(204,120,50)">, </span>namespacePrefix)<span style="color:rgb(204,120,50)">;<br></span>} <span style="color:rgb(204,120,50)">else </span>{<br> <span style="color:rgb(128,128,128)">// Namespace couldn't be resolved from any ancestor. If the namespace prefix is null then the<br></span><span style="color:rgb(128,128,128)"> // element is simply in the undeclared default document namespace, which is fine. If it isn't null<br></span><span style="color:rgb(128,128,128)"> // then a namespace prefix, that hasn't properly been declared, is being used.<br></span><span style="color:rgb(128,128,128)"> </span><span style="color:rgb(204,120,50)">if </span>(namespacePrefix != <span style="color:rgb(204,120,50)">null</span>) {<br> <span style="color:rgb(204,120,50)">throw new </span>DOMException(DOMException.<span style="color:rgb(152,118,170);font-style:italic">NAMESPACE_ERR</span><span style="color:rgb(204,120,50)">, </span><span style="color:rgb(106,135,89)">"Unable to resolve namespace prefix "<br></span><span style="color:rgb(106,135,89)"> </span>+ namespacePrefix + <span style="color:rgb(106,135,89)">" found on element " </span>+ QNameSupport.<span style="font-style:italic">getNodeQName</span>(domElement))<span style="color:rgb(204,120,50)">;<br></span><span style="color:rgb(204,120,50)"> </span>}<br>}</pre></div><div><br></div><div>The <i>namespaceURI</i> for <i>namespacePrefix</i> <b>ds</b> is <b>null</b>. During debug I've manually set it to "<i><b><a href="http://www.w3.org/2000/09/xmldsig#">http://www.w3.org/2000/09/xmldsig#</a></b></i>" then there won't be any errors thrown and it runs fine. Any idea whats happening?</div><div><br></div><div>Any answers would be appreciated,<br></div><div>Thanks,<br></div><div>Deshan Koswatte<br></div><div><span style="font-size:16.4px;font-family:monospace"></span></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Thu, Sep 5, 2019 at 4:04 AM Brent Putman <<a href="mailto:putmanb@georgetown.edu">putmanb@georgetown.edu</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div bgcolor="#FFFFFF">
<p><br>
</p>
<div class="gmail-m_797529106716503637moz-cite-prefix">On 9/2/19 2:46 AM, DD K wrote:<br>
</div>
<blockquote type="cite">
<div dir="ltr"><br>
<div>
<pre style="background-color:rgb(43,43,43);color:rgb(169,183,198);font-family:"DejaVu Sans Mono";font-size:9pt"><span style="color:rgb(204,120,50)">public static </span>Assertion <span style="color:rgb(255,198,109)">getDecryptedAssertion</span>(EncryptedAssertion encryptedAssertion<span style="color:rgb(204,120,50)">, </span>X509Credential x509Credential)
<span style="color:rgb(204,120,50)">throws </span>DecryptionException<span style="color:rgb(204,120,50)">, </span>KeyStoreException<span style="color:rgb(204,120,50)">, </span>UnrecoverableKeyException<span style="color:rgb(204,120,50)">, </span>NoSuchAlgorithmException {
KeyInfoCredentialResolver keyResolver = <span style="color:rgb(204,120,50)">new </span>StaticKeyInfoCredentialResolver(x509Credential)<span style="color:rgb(204,120,50)">;
</span><span style="color:rgb(204,120,50)"> </span>Decrypter decrypter = <span style="color:rgb(204,120,50)">new </span>Decrypter(<span style="color:rgb(204,120,50)">null, </span>keyResolver<span style="color:rgb(204,120,50)">, null</span>)<span style="color:rgb(204,120,50)">;
</span><span style="color:rgb(204,120,50)">
</span><span style="color:rgb(204,120,50)"> </span>EncryptedKey key = encryptedAssertion.getEncryptedData().getKeyInfo().getEncryptedKeys().get(<span style="color:rgb(104,151,187)">0</span>)<span style="color:rgb(204,120,50)">;
</span><span style="color:rgb(204,120,50)"> </span>SecretKey dkey = (SecretKey) decrypter.decryptKey(key<span style="color:rgb(204,120,50)">, </span>encryptedAssertion.getEncryptedData().
getEncryptionMethod().getAlgorithm())<span style="color:rgb(204,120,50)">; // Error caused here
</span><span style="color:rgb(204,120,50)"> </span>Credential shared = CredentialSupport.<span style="font-style:italic">getSimpleCredential</span>(dkey)<span style="color:rgb(204,120,50)">;
</span><span style="color:rgb(204,120,50)">
</span><span style="color:rgb(204,120,50)"> </span>decrypter = <span style="color:rgb(204,120,50)">new </span>Decrypter(<span style="color:rgb(204,120,50)">new </span>StaticKeyInfoCredentialResolver(shared)<span style="color:rgb(204,120,50)">, null, null</span>)<span style="color:rgb(204,120,50)">;
</span><span style="color:rgb(204,120,50)"> </span>decrypter.setRootInNewDocument(<span style="color:rgb(204,120,50)">true</span>)<span style="color:rgb(204,120,50)">;
</span><span style="color:rgb(204,120,50)"> return </span>decrypter.decrypt(encryptedAssertion)<span style="color:rgb(204,120,50)">;
</span>}</pre>
</div>
</div>
<br>
</blockquote>
<p><br>
</p>
<p>I think your main issue is that you are using 2 different
Decrypter instances, and you aren't invoking setRootInNewDocument
on the first one, which (I think) is required by how you are using
the output of it. Try that and see how it goes.</p>
<p>A secondary issue is that you don't really need to do all that.
The code above is needlessly complicated. You really just want 1
Decrypter, with appropriate ctor args of:<br>
- arg 0 as null<br>
- arg 1 as the static KeyInfo cred resolver containing the
X509 cred with private key (assuming you don't want a more
realistic resolution strategy)<br>
- arg 2 as an EncryptedKeyResolver covering how you are
placing the EncryptedKey relative to the EncryptedData.</p>
<p>Then it handles internally all of what you are doing - locating
and decrypting the EncryptedKey to SecretKey, then using that to
decrypt the EncryptedData.</p>
<p>It's also artificial to encrypt and then immediately decrypt in
that fashion. To fully test a round trip you really ought to at
least marshall the EncryptedAssertion to DOM and then unmarshall a
new EncryptedAssertion around it. Or even marshall and then
serialize it to something (e.g. byte[]) and then parse it again
and unmarshall.</p>
</div>
-- <br>
To unsubscribe from this list send an email to <a href="mailto:dev-unsubscribe@shibboleth.net" target="_blank">dev-unsubscribe@shibboleth.net</a></blockquote></div></div>