<div dir="ltr"><div>Hi Brent,</div><div><br></div><div>I've tried to marshall the encrypted assertion but the same error persists. I've debugged by comparing the OpenSAML2 project with the current OpenSAML3 project. In OpenSAML2 project, the encrypted Assertion had a dom and the encryptedData had the element [ds:KeyInfo:null] but in OpenSAML3 I don't see those. I currently have no idea what is happening in the process.</div><div><br></div><div>Encrypting Logic after the update<br></div><div><pre style="background-color:rgb(43,43,43);color:rgb(169,183,198);font-family:"DejaVu Sans Mono";font-size:9pt"><span style="color:rgb(204,120,50)">public </span>EncryptedAssertion <span style="color:rgb(255,198,109)">doEncryptedAssertion</span>(Assertion assertion<span style="color:rgb(204,120,50)">, </span>X509Credential cred<span style="color:rgb(204,120,50)">, </span>String alias<span style="color:rgb(204,120,50)">, </span>String<br> assertionEncryptionAlgorithm<span style="color:rgb(204,120,50)">, </span>String keyEncryptionAlgorithm) <span style="color:rgb(204,120,50)">throws </span>IdentityException {<br> <span style="color:rgb(204,120,50)">try </span>{<span style="color:rgb(128,128,128)"></span><span style="color:rgb(128,128,128)"><br></span><span style="color:rgb(128,128,128)"> </span>DataEncryptionParameters encParams = <span style="color:rgb(204,120,50)">new </span>DataEncryptionParameters()<span style="color:rgb(204,120,50)">;<br></span><span style="color:rgb(204,120,50)"> </span>encParams.setAlgorithm(assertionEncryptionAlgorithm)<span style="color:rgb(204,120,50)">;</span><span style="color:rgb(128,128,128)"><br></span><span style="color:rgb(128,128,128)"><br></span><span style="color:rgb(128,128,128)"> </span>KeyEncryptionParameters keyEncryptionParameters = <span style="color:rgb(204,120,50)">new </span>KeyEncryptionParameters()<span style="color:rgb(204,120,50)">;<br></span><span style="color:rgb(204,120,50)"> </span>keyEncryptionParameters.setAlgorithm(keyEncryptionAlgorithm)<span style="color:rgb(204,120,50)">;<br></span><span style="color:rgb(204,120,50)"> </span>keyEncryptionParameters.setEncryptionCredential(cred)<span style="color:rgb(204,120,50)">;</span><span style="color:rgb(128,128,128)"><br></span><span style="color:rgb(128,128,128)"><br></span><span style="color:rgb(128,128,128)"> </span>Encrypter encrypter = <span style="color:rgb(204,120,50)">new </span>Encrypter(encParams<span style="color:rgb(204,120,50)">, </span>keyEncryptionParameters)<span style="color:rgb(204,120,50)">;<br></span><span style="color:rgb(204,120,50)"> </span>encrypter.setKeyPlacement(Encrypter.KeyPlacement.<span style="color:rgb(152,118,170);font-style:italic">INLINE</span>)<span style="color:rgb(204,120,50)">;<br></span><span style="color:rgb(204,120,50)"><br></span><span style="color:rgb(204,120,50)"> </span>EncryptedAssertion encrypted = encrypter.encrypt(assertion)<span style="color:rgb(204,120,50)">;<br></span><span style="color:rgb(204,120,50)"> return </span>encrypted<span style="color:rgb(204,120,50)">;<br></span><span style="color:rgb(204,120,50)"> </span>} <span style="color:rgb(204,120,50)">catch </span>(Exception e) {<br> <span style="color:rgb(204,120,50)">throw </span>IdentityException.<span style="font-style:italic">error</span>(<span style="color:rgb(106,135,89)">"Error while Encrypting Assertion"</span><span style="color:rgb(204,120,50)">, </span>e)<span style="color:rgb(204,120,50)">;<br></span><span style="color:rgb(204,120,50)"> </span>}<br> }</pre></div><div><br></div><div>Decrypting Logic after the update</div><div><pre style="background-color:rgb(43,43,43);color:rgb(169,183,198);font-family:"DejaVu Sans Mono";font-size:9pt"><span style="color:rgb(204,120,50)">public static </span>Assertion <span style="color:rgb(255,198,109)">getDecryptedAssertion</span>(EncryptedAssertion encryptedAssertion<span style="color:rgb(204,120,50)">, </span>X509Credential x509Credential)<br> <span style="color:rgb(204,120,50)">throws </span>DecryptionException {<br><br> KeyInfoCredentialResolver keyResolver = <span style="color:rgb(204,120,50)">new </span>StaticKeyInfoCredentialResolver(x509Credential)<span style="color:rgb(204,120,50)">;<br></span><span style="color:rgb(204,120,50)"> </span>Decrypter decrypter = <span style="color:rgb(204,120,50)">new </span>Decrypter(<span style="color:rgb(204,120,50)">null, </span>keyResolver<span style="color:rgb(204,120,50)">, new </span>InlineEncryptedKeyResolver())<span style="color:rgb(204,120,50)">;<br></span><span style="color:rgb(204,120,50)"></span><span style="color:rgb(128,128,128)"><br></span><span style="color:rgb(128,128,128)"> </span>decrypter.setRootInNewDocument(<span style="color:rgb(204,120,50)">true</span>)<span style="color:rgb(204,120,50)">;<br></span><span style="color:rgb(204,120,50)"> return </span>decrypter.decrypt(encryptedAssertion)<span style="color:rgb(204,120,50)">;<br></span><span style="color:rgb(204,120,50)"> </span>}</pre></div><div><br></div><div>Any answers would be appreciated,</div><div>Thanks,</div><div>Deshan Koswatte<br></div><div><br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Fri, Sep 6, 2019 at 6:42 AM Brent Putman <<a href="mailto:putmanb@georgetown.edu">putmanb@georgetown.edu</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div bgcolor="#FFFFFF">
<p><br>
</p>
<div class="gmail-m_6398679291804422824moz-cite-prefix">On 9/5/19 5:03 AM, DD K wrote:<br>
</div>
<blockquote type="cite">
<div dir="ltr"> But the thing is still the error persists. And
I've debugged to see whats going on internally and I found that
at class net.shibboleth.utilities.java.support.xml.NameSupport
on the code snippet :
<div><br>
</div>
<div>The <i>namespaceURI</i> for <i>namespacePrefix</i> <b>ds</b>
is <b>null</b>. During debug I've manually set it to "<i><b><a href="http://www.w3.org/2000/09/xmldsig#" target="_blank">http://www.w3.org/2000/09/xmldsig#</a></b></i>"
then there won't be any errors thrown and it runs fine. Any
idea whats happening?<br>
</div>
</div>
<br>
</blockquote>
<p>I'm not 100% sure, but I suspect it might be related to the round
tripping you're doing in your testing. Probably something related
to the DOM being re-used is causing a problem with all the complex
namespace handling we have to do. The 'ds' prefix for XML
Signature is a common one and ought to be in the
EncryptedAssertion in the correct place. We know it is in real
world use cases, this code has been in production use for over 12
years or so.<br>
</p>
<p>For this kind of artificial testing, I'd try my earlier
suggestion: After encryption, completely marshall and serialize
the EncryptedAssertion to something, like a temp File or byte[];
then parse the File/byte[]/etc and unmarshall to get a fresh new
EncryptedAssertion, and then decrypt that.<br>
</p>
</div>
</blockquote></div>