Decoding encrypted attributes from an IDP
Rob Whitener
rob.whitener at audaxhealth.com
Tue Jul 24 09:19:09 EDT 2012
I went ahead and ran the assertion through a pretty printer and pulled out
the encrypted assertion (below). I see that the assertion data is
encrypted with AES, and the AES key itself is encrypted with rsa1.5. What
I learned about PKI, I learned about 10 years ago in undergrad so forgive
me if the question I ask seems painfully obvious. Is our partner using our
public key to encrypt the AES key, which we need to decrypt with our
private key and then use that to decrypt the assertion itself? When I look
at the logs, it appears that things fall apart when it tries to process
"message against SAML 2.0 SSO profile":
2012-07-24 12:45:57 DEBUG OpenSAML.SecurityPolicyRule.XMLSigning [21]:
signature verified against message issuer
2012-07-24 12:45:57 DEBUG Shibboleth.SSO.SAML2 [21]: processing message
against SAML 2.0 SSO profile
2012-07-24 12:45:57 DEBUG XMLTooling.KeyInfoResolver.Inline [21]: resolved
0 certificate(s)
2012-07-24 12:45:57 DEBUG XMLTooling.CredentialCriteria [21]: key algorithm
didn't match ('AES' != 'RSA')
2012-07-24 12:45:57 DEBUG XMLTooling.KeyInfoResolver.Inline [21]: resolved
0 certificate(s)
2012-07-24 12:45:57 DEBUG XMLTooling.CredentialCriteria [21]: credential
name(s) didn't overlap
2012-07-24 12:45:57 ERROR Shibboleth.SSO.SAML2 [21]: Unable to resolve any
key decryption keys.
2012-07-24 12:46:08 INFO Shibboleth.Listener [18]: detected socket closure,
shutting down worker thread
2012-07-24 12:46:38 INFO Shibboleth.Listener [21]: detected socket closure,
shutting down worker thread
2012-07-24 12:54:16 DEBUG Shibboleth.Listener [22]: dispatching message
(default/Metadata)
Are we trying to use AES to decrypt something encrypted by RSA
inadvertently?
<saml:EncryptedAssertion>
<EncryptedData xmlns="http://www.w3.org/2001/04/xmlenc#"
Id="uuidb905a739-0138-1072-949c-ee2b588c9055" Type="
http://www.w3.org/2001/04/xmlenc#Element">
<EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#aes128-cbc
"/>
<ds:KeyInfo>
<EncryptedKey Id="uuidb905a73a-0138-1d38-9a0a-ee2b588c9055">
<EncryptionMethod Algorithm="
http://www.w3.org/2001/04/xmlenc#rsa-1_5"/>
<ds:KeyInfo>
<ds:KeyName>EMAILADDRESS=cloudops at audaxhealth.com, CN=
www.dev.careverge.com, OU=Cloud Ops, O=Audax Health Inc., L=Washington,
ST=District of Columbia, C=US</ds:KeyName>
</ds:KeyInfo>
<CipherData>
<CipherValue>...</CipherValue>
</CipherData>
</EncryptedKey>
</ds:KeyInfo>
<CipherData>
<CipherValue>...</CipherValue>
</CipherData>
</EncryptedData>
</saml:EncryptedAssertion>
On Tue, Jul 24, 2012 at 8:28 AM, Rob Whitener
<rob.whitener at audaxhealth.com>wrote:
> This is helpful. I don't have a key and cert in PEM format. I just have
> a .key and a .crt (well, at least I don't think I have it in PEM format).
> I will look into this some more.
>
> When I run the openssl command against the cert, I do get back that
> information.
>
>
> On Tue, Jul 24, 2012 at 3:45 AM, Yannick Béot <yannick.beot at gmail.com>wrote:
>
>> I would not bother about the UUID.
>> Inside your shibboleth configuration, you should have something like
>> <CredentialResolver type="File" key="sp-key.pem"
>> certificate="sp-cert.pem"/>
>>
>> Use the following openssl command to get the subject of the certificate:
>> openssl x509 -in sp-cert.pem -subject -noout
>>
>> You should see something like
>> subject= /EMAILADDRESS=cloudops at audaxhealth.com/ CN=www.dev.careverge.com/OU=Cloud
>> Ops/O=Audax Health Inc./ L=Washington/ST=District of Columbia/C=US
>>
>> How did you get the metadata you sent to your IdP?
>>
>> In any case, I would to try to exchange again the metadata.
>>
>> Y.
>>
>>
>> On Mon, Jul 23, 2012 at 10:54 PM, Rob Whitener <
>> rob.whitener at audaxhealth.com> wrote:
>>
>>> Its hard to tell. I have this in the assertion for the encrypted
>>> assertion:
>>>
>>> </EncryptionMethod><ds:KeyInfo><EncryptedKey
>>> Id="uuidb5469dbb-0138-1020-ab16-fef9662dd66c"><EncryptionMethod Algorithm="
>>> http://www.w3.org/2001/04/xmlenc#rsa-1_5
>>> "></EncryptionMethod><ds:KeyInfo><ds:KeyName>EMAILADDRESS=
>>> cloudops at audaxhealth.com, CN=www.dev.careverge.com, OU=Cloud Ops,
>>> O=Audax Health Inc., L=Washington, ST=District of Columbia,
>>> C=US</ds:KeyName>
>>>
>>> Where it looks like the encrypted key is being looked up by UUID. There
>>> is a key in the asswertion, but the assertion indicates it is used for the
>>> signature. Comparing the key in the assertion to the keys in the IDP
>>> metadata, it looks like the same key that is used for both encryption and
>>> signing (odd). I have no UUID indicators in the metadata anywhere, so I am
>>> not sure if there is another way to see either what the UUID is indexing or
>>> how it is being used.
>>>
>>> Thanks,
>>>
>>> Rob
>>>
>>>
>>> On Mon, Jul 23, 2012 at 4:30 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:
>>>
>>>> On 7/23/12 4:14 PM, "Rob Whitener" <rob.whitener at audaxhealth.com>
>>>> wrote:
>>>> >
>>>> >At Scott Cantor's suggestion, I asked our partner to encrypt the whole
>>>> >assertion, rather than just the attributes (they took it upon
>>>> themselves
>>>> >to have the attributes remain encrypted as well, inside the already
>>>> >encrypted assertion? Seems like too much encryption
>>>> > to me).
>>>>
>>>> It also won't fix your issue, although...
>>>>
>>>> >Now, we are seeing errors like this in Syslog:
>>>> >
>>>> >Jul 23 19:18:21 ip-10-90-230-192 shibboleth-sp: 1343071101 ERROR
>>>> >Shibboleth.Listener [24585] shib_check_user: remoted message returned
>>>> an
>>>> >error: A valid authentication statement was not found in the incoming
>>>> >message.
>>>>
>>>> That means you can't decrypt with the key they used, as Nate said, and
>>>> that should also be happening in the original case of the
>>>> EncryptedAttribute (not in syslog, it will just be a warning in
>>>> shibd.log).
>>>>
>>>> -- Scott
>>>>
>>>> --
>>>> To unsubscribe from this list send an email to
>>>> users-unsubscribe at shibboleth.net
>>>>
>>>
>>>
>>> --
>>> To unsubscribe from this list send an email to
>>> users-unsubscribe at shibboleth.net
>>>
>>
>>
>> --
>> To unsubscribe from this list send an email to
>> users-unsubscribe at shibboleth.net
>>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20120724/c1d772a9/attachment.html
More information about the users
mailing list