Decoding encrypted attributes from an IDP

[Rob Whitener]

At Scott Cantor's suggestion, I asked our partner to encrypt the whole
assertion, rather than just the attributes (they took it upon themselves to
have the attributes remain encrypted as well, inside the already encrypted
assertion? Seems like too much encryption to me).

Now, we are seeing errors like this in Syslog:

Jul 23 19:18:21 ip-10-90-230-192 shibboleth-sp: 1343071101 ERROR
Shibboleth.Listener [24585] shib_check_user: remoted message returned an
error: A valid authentication statement was not found in the incoming
message.

And this in shibd.log:
2012-07-23 19:19:33 DEBUG XMLTooling.CredentialCriteria [16]: key algorithm
didn't match ('AES' != 'RSA')

Is this something I can modify in our config?  I am certain that their
metadata told us they would be using RSA, and since those are two
completely different encryption modes, it seems like this might be more
them than us?

Thanks,

Rob

On Fri, Jul 20, 2012 at 3:59 PM, Rob Whitener
<rob.whitener at audaxhealth.com>wrote:

> Yeah, I'm not blind, and just to double check I have looked through these
> logs several times and uncommented all the logging options.  I am surprised
> that it would ignore the EcryptedAttribute element, since the docs
> specifically mention it:
>
>
> https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPAttributeExtractor
>
> I am on 2.3, so maybe that is the issue.
>
> Rob
>
>
> On Fri, Jul 20, 2012 at 3:56 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:
>
>> On 7/20/12 3:53 PM, "Rob Whitener" <rob.whitener at audaxhealth.com> wrote:
>> >
>> >Ah, got it, I misunderstood.
>>
>> Code-wise, I also can verify that if it's not outright buggy and ignoring
>> the element, the extractor will dump the decrypted XML on DEBUG, so that's
>> all that should be needed to spot it doing that, or reporting an error.
>> That strongly suggests to me it might be buggy or you're blind, and I
>> doubt you're blind.
>>
>> -- Scott
>>
>> --
>> To unsubscribe from this list send an email to
>> users-unsubscribe at shibboleth.net
>>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20120723/c85831ff/attachment.html