Decoding encrypted attributes from an IDP

[Rob Whitener]

Hi All,

Our partner (IDP) is making use of encryption when sending assertions to
our SP.  I am getting errors indicating that an AttributeStatement is
present, but contains no attributes.  When I look at the actual assertion,
I see these inside of the AttributeStatement element:

<saml:EncryptedAttribute><EncryptedData xmlns="
http://www.w3.org/2001/04/xmlenc#" Id="
uuida4ff45ee-0138-1608-b6d3-8f0c9cec183c" Type="
http://www.w3.org/2001/04/xmlenc#Element"><EncryptionMethod Algorithm="
http://www.w3.org/2001/04/xmlenc#aes128-cbc"></EncryptionMethod><ds:KeyInfo><EncryptedKey
Id="uuida4ff45ef-0138-171b-8a47-8f0c9cec183c"><EncryptionMethod Algorithm="
http://www.w3.org/2001/04/xmlenc#rsa-1_5"></EncryptionMethod><ds:KeyInfo>
<ds:KeyName>EMAILADDRESS=cloudops at audaxhealth.com, CN=www.dev.careverge.com,
OU=Cloud Ops, O=Audax Health Inc., L=Washington, ST=District of Columbia,
C=US</ds:KeyName></ds:KeyInfo><CipherData><CipherValue>
QUjVNf4g87ESOQqdWc/36NAcjoA3kspLaGNmrKNyYWAuABr4mP2Hx6x/S4qUv7rbmEwqJBrdLuDQf6CmZyuYvN5wFLMNUT/HqSqNZYqb9yvUTD7RNZvP77QcQhdEs4jpTRTRE26Xkus0HgcoV4U1tlaWchkoCwxznz4zf4k3J1VlTt4Rzowatp8zKxJJDiQXXTWFvWX6UdANVtjOgc2IrGn6f9t94EYISvrfYa/ynhy9BbSC8paaEmIovF2vPLTN9PQAT5somM0M60W6iys2UKW3jfxMC8bFilagPU5qGdfNKhc80pqRgwoDqTidhyl3E78hmbTHuzbexWNhCzBZKA==
</CipherValue></CipherData></EncryptedKey></ds:KeyInfo><CipherData>
<CipherValue>
tfZgyTVIab8ofiHezBwK0OJjgUYxcG12YkJGs2Vp1/EhgtvxUemL8OZlVrEV+XswQZM+7aIc509bVx6TYGr5Ru38CLppvSCMDIe8xPDCZY1naIkwzChymVrYxnkFPP1J5SBtfWN8MjgjZ0ftYltRbD3DFmWxaoIVRrbpZ7Lgk5UKaAQd3xp+eUfLNVCIxW7lg44VI9iZ81cUpXKlYYDw8EhIi/xEa+bM5gi1x7RWTSp/Lrs3tU/+wDkiOI+Oqm3h0nuc2Sh/h1gkI5TktTxKTKDpqnBA81zTfdItPybD8g0lZux8Q49zp7KggzNk5ZX+UMlK3jqXH16uqwbETODlzKKByvJyUvUU8ArWZBl0B+TIdOcgo5MFl3Li1vxTI8G80iCayG9ajsySkcOP9YJLTQyXo9sAO6CEZj8LXa3QIb23lzMSHbUCYrZFWpycslmT
</CipherValue></CipherData></EncryptedData></saml:EncryptedAttribute>

So there appear to be attributes, but my SP is unable to decrypt them. From
reading the docs, I found that the <AttributeExtractor> will support
<saml2:EncryptedAttribute> elements, but I see we are getting
<saml:EncryptedAttribute>. Could this be causing us to not properly handle
the elements? Also, on ApplicationDefaults, I have encrypted=true (which I
think only applies to outbound messages though)

Thank you,

Rob

PS: I would like to add that of all the open source message boards I have
used, the shib folks respond the fastest, hands down. Thank you for that.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20120720/484081bf/attachment-0001.html