Decoding encrypted attributes from an IDP

[Rob Whitener]

Thanks for getting back to me.  The saml prefix is indeed defined based on
the smal2 namespace.  Also, I did see in the logs what looks like the
encrypted attributes getting unpacked:

2012-07-20 17:21:50 DEBUG XMLTooling.XMLObject.Builder [1]: located
XMLObjectBuilder for element name: saml:EncryptedAttribute
2012-07-20 17:21:50 DEBUG XMLTooling.XMLObject [1]: unmarshalling child
element (saml:EncryptedAttribute)
2012-07-20 17:21:50 DEBUG XMLTooling.XMLObject [1]: unmarshalling DOM
element (saml:EncryptedAttribute)
2012-07-20 17:21:50 DEBUG XMLTooling.XMLObject [1]: unmarshalling child
nodes of DOM element (saml:EncryptedAttribute)
2012-07-20 17:21:50 DEBUG XMLTooling.XMLObject.Builder [1]: located
XMLObjectBuilder for element name: {
http://www.w3.org/2001/04/xmlenc#}EncryptedData
2012-07-20 17:21:50 DEBUG XMLTooling.XMLObject [1]: unmarshalling child
element ({http://www.w3.org/2001/04/xmlenc#}EncryptedData)
2012-07-20 17:21:50 DEBUG XMLTooling.XMLObject [1]: unmarshalling DOM
element (EncryptedData)
2012-07-20 17:21:50 DEBUG XMLTooling.XMLObject [1]: unmarshalling
attributes for DOM element (EncryptedData)
2012-07-20 17:21:50 DEBUG XMLTooling.XMLObject [1]: processing generic
attribute
2012-07-20 17:21:50 DEBUG XMLTooling.XMLObject [1]: processing generic
attribute

...

2012-07-20 17:21:50 DEBUG XMLTooling.XMLObject.Builder [1]: located
XMLObjectBuilder for element name: {
http://www.w3.org/2001/04/xmlenc#}CipherData
2012-07-20 17:21:50 DEBUG XMLTooling.XMLObject [1]: unmarshalling child
element ({http://www.w3.org/2001/04/xmlenc#}CipherData)
2012-07-20 17:21:50 DEBUG XMLTooling.XMLObject [1]: unmarshalling DOM
element (CipherData)
2012-07-20 17:21:50 DEBUG XMLTooling.XMLObject [1]: unmarshalling child
nodes of DOM element (CipherData)
2012-07-20 17:21:50 DEBUG XMLTooling.XMLObject.Builder [1]: located
XMLObjectBuilder for element name: {
http://www.w3.org/2001/04/xmlenc#}CipherValue
2012-07-20 17:21:50 DEBUG XMLTooling.XMLObject [1]: unmarshalling child
element ({http://www.w3.org/2001/04/xmlenc#}CipherValue)
2012-07-20 17:21:50 DEBUG XMLTooling.XMLObject [1]: unmarshalling DOM
element (CipherValue)
2012-07-20 17:21:50 DEBUG XMLTooling.XMLObject [1]: unmarshalling child
nodes of DOM element (CipherValue)
2012-07-20 17:21:50 DEBUG XMLTooling.XMLObject [1]: processing text content
at position (0)
2012-07-20 17:21:50 DEBUG XMLTooling.XMLObject.Builder [1]: located
XMLObjectBuilder for element name: {
http://www.w3.org/2001/04/xmlenc#}CipherData
2012-07-20 17:21:50 DEBUG XMLTooling.XMLObject [1]: unmarshalling child
element ({http://www.w3.org/2001/04/xmlenc#}CipherData)
2012-07-20 17:21:50 DEBUG XMLTooling.XMLObject [1]: unmarshalling DOM
element (CipherData)
2012-07-20 17:21:50 DEBUG XMLTooling.XMLObject [1]: unmarshalling child
nodes of DOM element (CipherData)
2012-07-20 17:21:50 DEBUG XMLTooling.XMLObject.Builder [1]: located
XMLObjectBuilder for element name: {
http://www.w3.org/2001/04/xmlenc#}CipherValue
2012-07-20 17:21:50 DEBUG XMLTooling.XMLObject [1]: unmarshalling child
element ({http://www.w3.org/2001/04/xmlenc#}CipherValue)
2012-07-20 17:21:50 DEBUG XMLTooling.XMLObject [1]: unmarshalling DOM
element (CipherValue)
2012-07-20 17:21:50 DEBUG XMLTooling.XMLObject [1]: unmarshalling child
nodes of DOM element (CipherValue)
2012-07-20 17:21:50 DEBUG XMLTooling.XMLObject [1]: processing text content
at position (0)

and then after the last one of those, I see:

012-07-20 17:22:02 INFO Shibboleth.Listener [1]: detected socket closure,
shutting down worker thread

I don't see any actual errors anywhere, but I do know from looking at the
transaction log that none of the encrypted data is being used for anything
(the transaction log shows no activity).  Do I have to do something on the
Attribute definitions (in my extractor) to tell them to decrypt attributes,
or does that happen automagically?

Thanks,

Rob

On Fri, Jul 20, 2012 at 12:54 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:

> > So there appear to be attributes, but my SP is unable to decrypt them.
> From
> > reading the docs, I found that the <AttributeExtractor> will support
> > <saml2:EncryptedAttribute> elements, but I see we are getting
> > <saml:EncryptedAttribute>. Could this be causing us to not properly
> handle
> > the elements?
>
> No, not unless that prefix isn't declared somewhere to be the right
> namespace. If it's not handling them, there should be logs indicating why,
> but I don't know that this has ever been tested. I can't recall whether I
> ever tried it in an interop event, and the IdP we have doesn't support the
> feature (only at the assertion level).
>
> > Also, on ApplicationDefaults, I have encrypted=true (which I
> > think only applies to outbound messages though)
>
> It does.
>
> > PS: I would like to add that of all the open source message boards I have
> > used, the shib folks respond the fastest, hands down. Thank you for that.
>
> Thank you for noticing.
>
> -- Scott
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20120720/2e3f4068/attachment.html