Decoding encrypted attributes from an IDP

[Rob Whitener]

Its hard to tell. I have this in the assertion for the encrypted assertion:

</EncryptionMethod><ds:KeyInfo><EncryptedKey
Id="uuidb5469dbb-0138-1020-ab16-fef9662dd66c"><EncryptionMethod Algorithm="
http://www.w3.org/2001/04/xmlenc#rsa-1_5
"></EncryptionMethod><ds:KeyInfo><ds:KeyName>EMAILADDRESS=
cloudops at audaxhealth.com, CN=www.dev.careverge.com, OU=Cloud Ops, O=Audax
Health Inc., L=Washington, ST=District of Columbia, C=US</ds:KeyName>

Where it looks like the encrypted key is being looked up by UUID.  There is
a key in the asswertion, but the assertion indicates it is used for the
signature.  Comparing the key in the assertion to the keys in the IDP
metadata, it looks like the same key that is used for both encryption and
signing (odd).  I have no UUID indicators in the metadata anywhere, so I am
not sure if there is another way to see either what the UUID is indexing or
how it is being used.

Thanks,

Rob


On Mon, Jul 23, 2012 at 4:30 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:

> On 7/23/12 4:14 PM, "Rob Whitener" <rob.whitener at audaxhealth.com> wrote:
> >
> >At Scott Cantor's suggestion, I asked our partner to encrypt the whole
> >assertion, rather than just the attributes (they took it upon themselves
> >to have the attributes remain encrypted as well, inside the already
> >encrypted assertion? Seems like too much encryption
> > to me).
>
> It also won't fix your issue, although...
>
> >Now, we are seeing errors like this in Syslog:
> >
> >Jul 23 19:18:21 ip-10-90-230-192 shibboleth-sp: 1343071101 ERROR
> >Shibboleth.Listener [24585] shib_check_user: remoted message returned an
> >error: A valid authentication statement was not found in the incoming
> >message.
>
> That means you can't decrypt with the key they used, as Nate said, and
> that should also be happening in the original case of the
> EncryptedAttribute (not in syslog, it will just be a warning in shibd.log).
>
> -- Scott
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20120723/7b4f42c9/attachment-0001.html