Decoding encrypted attributes from an IDP

[Cantor, Scott]

On 7/23/12 4:54 PM, "Rob Whitener" <rob.whitener at audaxhealth.com> wrote:

>Its hard to tell. I have this in the assertion for the encrypted
>assertion:
>
></EncryptionMethod><ds:KeyInfo><EncryptedKey
>Id="uuidb5469dbb-0138-1020-ab16-fef9662dd66c"><EncryptionMethod
>Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-1_5"></EncryptionMethod><d
>s:KeyInfo><ds:KeyName>EMAILADDRESS=cloudops at audaxhealth.com,
> CN=www.dev.careverge.com <http://www.dev.careverge.com>, OU=Cloud Ops,
>O=Audax Health Inc., L=Washington, ST=District of Columbia,
>C=US</ds:KeyName>
>
>
>Where it looks like the encrypted key is being looked up by UUID.

No, but it's being named. That can break things. If they're generating a
key name for your key that doesn't match any of the automatically
extracted names, such as the subject DN, or subjectAltNames, then you may
need to hack around that by adding extractKeyNames="false" to your
credential resolver.

-- Scott