Key Info Configuration

Thu Jun 6 05:15:29 EDT 2013

Hi all,

I'm looking to ask a question about opensaml and am hoping that this is the
place to do so.

My team is using opensaml 2.5.3 to generate saml tokens for a project we
are working on. Currently, our SAML token's look like this:

<?xml version="1.0" encoding="UTF-8"?>

<saml2p:Response xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol"

Destination="
http://pingnodeone.barclays.intranet:8080/demospapplication/samldisplay"

Version="2.0">

<saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"

 xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"

 xsi:schemaLocation="urn:oasis:names:tc:SAML:2.0:assertion">
identity.secure.barclays.com</saml2:Issuer>

<ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">

 <ds:SignedInfo>

 <ds:CanonicalizationMethod Algorithm="
http://www.w3.org/2001/10/xml-exc-c14n#" />

 <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"
/>

 <ds:Reference URI="">

  <ds:Transforms>

  <ds:Transform

   Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" />

  <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />

  </ds:Transforms>

  <ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" />

  <ds:DigestValue>rocEKkS/8cZ/My3cEPFtURhSW/Y=</ds:DigestValue>

 </ds:Reference>

 </ds:SignedInfo>

 <ds:SignatureValue>
U1aGdRLm4GmQiNkD/W9ORZLoNpiv1yOsYoad+XveRT4HqDG+UpigMImSYRI7wGTDGHkeK1noy3jusEhNzzBIT91lGjrrFyuSkDFMBetrdmJJFeDGCQ5s60iD6OFhlkhSB4iCgaTRtBvT44ligFGHeJuLfXlL7qyGkiROCF4mjAVjmhj97TCQS+xJhKVkfEFgIdBGlXTYZFiAz090SElzRClQIcozT4+SJRkLRL3GrcWqX1awRm826DPoMAZri9f1qjqFFYL7zpbAQScaezi8DxbvziLRJykp11hKnau2EoWp9o627XgDvD5Bvu7Fa95J3wuzTZHaRcRuY/t+tzJpaA==

 </ds:SignatureValue>

</ds:Signature>

<saml2p:Status>

 <saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" />

</saml2p:Status>

<saml2:EncryptedAssertion xmlns:saml2=
"urn:oasis:names:tc:SAML:2.0:assertion">

 <xenc:EncryptedData xmlns:xenc="http://www.w3.org/2001/04/xmlenc#"

 Id="_a04f85fb05fda175a5e7eba026640f16" Type="
http://www.w3.org/2001/04/xmlenc#Element">

 <xenc:EncryptionMethod Algorithm="
http://www.w3.org/2001/04/xmlenc#aes128-cbc"

  xmlns:xenc="http://www.w3.org/2001/04/xmlenc#" />

 <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">

  <ds:RetrievalMethod Type="http://www.w3.org/2001/04/xmlenc#EncryptedKey"

  URI="#_9b07dd8a259d8ee8162adf17cd761d34" />

 </ds:KeyInfo>

 <xenc:CipherData xmlns:xenc="http://www.w3.org/2001/04/xmlenc#">

  <xenc:CipherValue>
mGrwQumPCnQotiGSzCQbmG5V3e2pipVwYlesoLEsesmSWGxJ5AjXTOvLZeY35qeTv4/UYSLGq1v3QyBDmXLccdfztYsZfHAqau9oh4alyF/uC+h0SIW03gnlKJQ1XabCy0qIqBj6W3xqKzRAwlqC7uL34LqbBaoFIcl6SCf2Bime7zQVN/eU0vWXefFetlrMA6at51UdFvEUe37MAORoK54LdP5QB6LR5PatORwQ+XupsGV4fs9x0fTJdQ+S1sjJnOZ9K7Kau8zFxy2Y4KIMybzIwMTZzun95QRJczWcArOYVo8VueqsmveUAKMjt3XPYQl4YoIrLk7k6fCNi1CLw5VVDmHxaBAXVMA7jOwbPPZYHIYkMXEMZmcpGewtj8a0WDTwgQpA1Mhzvyfn90PHhQaWb9zfPaXqredKVY8n/VK1UhghSMlnByVJNz5KFyQLD8FoFpYORuPvU7szrOSTO3/MO6NA7n4/dvgbBnqCjFaJaBhyFOBjrvslZ8+O3jSZbX+Y2GVgpfNEwjmoqsw+tPeg55cAHjE3fv9rewkkLpQ1EE+TlHE0MXKMCmqoblp0wSt5iWN0EJSmKiNA7caZVcABZHx+eZ/lmr33E00WAQovgoShenXg96rZLREu+
Fa
+yP/GEruiuX0+Co6+qdY9cFLebtWy/cimKixV37Lnz07+WBEGNlJNj8NdWuDN5cvdaZzEJtNdhduLbvwShtQuyrL4DIesLCt5LHmRLuahVCAyVoeE0cjnBz+/57k7G9kTGys0EnVP2TKfHP3sAsAQ3PneGgxSurZLLGuJZQz6fRLmZXGH2hXZ/lEQYH1nNl0udVTDOPD/nki8G7SmXvGV+oyLyGjnNyIfgeUCbCD28sEthIQK3g15+vxeBlY4k6HicgcoEayOOAMkd4uhwz8ffxHP5M3iM2KHqR6Fu61IiUrTSjhAlocW1wu2RS0ueTBzHV56Iv+WgSawyWQrTXDSR1C0k8b4twh8PDeQRuSMsYfsrP8je1dIlRC/a+t2flasTYSvfb+U0ks/ubBTXa7rmkhl2+63QX375v5c4R9vsRMUmv3HNmXiluFxx9cSrNzYgS+8J2/vEtLumr48vnz1kGN5OiPbyP8eDanGvSKXBDeglc4d+EfxaVgp3Xc7RpzM8MIsKtPMP+kUoXq0JMvasU9biyzB00f0b3+1bEDOIG5x/xqvtPyXPZJ+vZC/MjHqq559BBlEd7Qaes4v+xUfP1w3Cn1sf1iSNud+JBQNpPP2suQL5Kyun0W5x50HxyVl2aG1GAq0DnGgIP+3jPhaHnYr6XIzhua1ZOJ3ZwkNcyeJ9PwCTmoKywJU1S0cQ61/dfxxssXR+2xEpu7JBukzrZ6DenUJ+352u+M0rigXXDoyQqWQGgnXOTiyJ5VfVVSn/HEoUHA1Gi5DX1EWNeIeOz14rUstMCkfl0JOacZKgefjPupYVqzCUuVb/OVi7UpMlwaFiloyj8MVJOf70p9s9NhoNMbA/TZc61wNSWfJl2rY7StbCsCtXHy9gq1W1loL16A+mngXRn9Fii4n1WIjiwY8iuBTRsWDCg/n5W5b5ke4gkmMnsVLeKJG218w9qVHeGbQ8MQSGCEatYTrMqjoqcJgxYm+E7JfXvfibDpQrAJlExyMdr4YcxUOXjgywdbySd4HQT5ZYgp9r+jwK5JFzjlWQhjtTc/1A4YnPfu/IKiU3r4xE7Hjud3DEEpHlwsSCmMMaN+5+M1+/ZUg5A6GPZ2fAfYe+QW8Bhj9WtoKR8RY3gia/v+IcQELR8/WW7y7D3bmRtUATPSzSGtwSdJoyg2hf/ZEazzpZNqwP+W3Vdgwh9hVX3K9DjSC4NuSrVaiu45Ut8KlPItD/BwQaoVjSGV97Y8giz3VvznF1SbjxVouG7IN8iaZNHHS0gwnnhzJ8KZj46pIw0AAn/jpXKutY1P9OcojAdtHi0dNF4l6CXjyrOMQlaKmnkV4ZrOEk7M/A2y1yY8UrIBwqV3lWvuMSohShw5t4deskmJg4mflN8Lpgj2ah75WfMBFN+12BDyNbUJATGse5dnGNAyKMsvervmKnYzAjO2Ri+uXtSJTQ0DxeKtFtw3Cjox+FydAxlwRyVGbGSl7s7gIaGKKYl5wQXQJaFwzsEvBWssNVTFamy9H5YU5nYYrBXcj6Y9kuuOBv/LMH1gmVqL81ujSZtxrg5nQrPn427J7TFyu3gM0NqQdHlZsafFp0ZUDEokY+HZSRO8a5AO1fZWirkcxbe5DUWMTMVm0KJ/pQ95VbIxFk0V5uDV4YTEvn0VQfnNduYdc6Pe+vSYOaHbpWchugazDLW66ZpL3W/R9/G0ELBoJmEmQ1qpTXa+i/bjkjigfsYUSpm0g7nzRBXk+dbbUy0gkyQNtozABZF3wTeFPN4uD8nLIZlzIDp1bEjsFYiV0iixzyW1wfz+rCcRrfBFQMijnQSxm7QrAttwC/MCdMLnbL3/QQspqx5wuRs24lfrp+26BBfv82GGTqsRHxU5/5nfY3w0ccsCE2l6hlsL26/pNg/1MWTm4+0CYInjAZKWF19lYdFQzLE3JWzUQCmlZEvjvWNhC3uxnVs+cRrZEnmW90/Ldg8VZ4jrFJ2+IF6UNJVHgD9vmJJ0XWpki8Qj81oFa3Bj0gMhwiH/uVeCKErO9svH7Q6vcFg1sENh2puidMdMfApiCqR536kcwai5gA9ImhlaZLkmfpSf2TaluhoCrMCcmYRVCeflevxpKSQAqQYxUjWq/rA6PwbjrXYMP8ZPh3k1d2tNDIq34AeOJs5x2uR5HECBP0e+E6eRhtzAPurAlDQg3Xebw/r8Fd+LS/xm7aMRyBY6xO6r9X9kqMUqsFPYubGDkDHI6iU7dH/PdviDyLQ6i4zEcxBwpmQGbUjRAbQvEWB6GvmQo8u5jimoE/yUpzNonIeMbNnw6LlbZ2d0BnhvKfWChew8rLBHyRocZK5C6AEwuqrs3yXNYfaZnwOm+nbxkQPjH5rVymZBF7jsccJ1YZWotjuNy1stIzh/zu0QR1ps2Yy5I2rNnC+PQMNRoQgg/gc4ajyXxG4hsc+0+6y4PsSLkA9MpHBf2+w1/cK6Y0OIlxBpV4K7H7ZrO/r5nAgHN1n7tTvOADcNXSFz4F0HZQp/Td3e+yOvAPFZu8t076FTWYcchmkBbRmaDEZYFEa0MHBYxVaAey4/14xH5aWilOUggiZtVpYUPN79DX0MXctvbY/xTsvWXZx9uPOOPVfXf74mt8Z5Dsx3zLLYzLbkd6+WIzQ3IJOh/4hp9SL1N3Y50VRQkg52oCxSdwGKpPDzxPpi6G0lXBZW7BzG4JAr7rFWC8M3V0MY7aOGNepHKsAI0ypBKQLA2xRihwq+qxxHU4DNAeurW/z6kP0nja55YlFQZF0csw46f6aNKlGxIwZVeQgzx1uNWn2g9b2fIUHNs8YuU6NMHDKDXVefXvXDONVwhmMgowvNKXhj2aTBOMJce/5uL86vHDrCoZVZx+L08liRN6ePCvN8BNkpgqT8ydnRxxWLQtYZQSWKymUJ8B6MJh3fPs+TMj5rPMxQ0Du5VXYxBsm90HnSb3b5ngDSoTKhkcT83RPBrA5z1KFf7KpA1JYp0CnmnYD58jlL2HccOXiyQSPGmwJiepHm/yDu4tcALpFDA9f6HjzpZnsV0hg6DHLT263vZbF/DB+8=

  </xenc:CipherValue>

 </xenc:CipherData>

 </xenc:EncryptedData>

 <xenc:EncryptedKey xmlns:xenc="http://www.w3.org/2001/04/xmlenc#"

 Id="_9b07dd8a259d8ee8162adf17cd761d34">

 <xenc:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-1_5"

  xmlns:xenc="http://www.w3.org/2001/04/xmlenc#" />

 <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">

  <ds:X509Data>

  <ds:X509Certificate>
MIIC4DCCAcigAwIBAgIEUUrqgDANBgkqhkiG9w0BAQUFADAyMTAwLgYDVQQDEydCRFNQVUtMNzAz

NDIzODUuY2xpZW50LmJhcmNsYXlzY29ycC5jb20wHhcNMTMwMzIxMTEwOTUyWhcNMTQwMzIxMTEw

OTUyWjAyMTAwLgYDVQQDEydCRFNQVUtMNzAzNDIzODUuY2xpZW50LmJhcmNsYXlzY29ycC5jb20w

ggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCmWG7p7iATCM06WMsKg8LlLg8AXUvyZI6l

hZkz7Sc/moL6WtSUBrL60joLAi4L+P/VrbtZMNzP9kh3uyW0uZ0Vb+DhsXMQBccgdQMzq//nK2GN

0+/F4KYKLsdYpecR28YlOQRl2Y6Gc3i8PZIk2a8bmf64tbOCyOWHzX7fNHo+MSM3JcWOLltFKZCT

z8O8OJjhFqxA7fl+zLBEXprJZtxU/AOaLW6qBPh8w1LmIfU8nK5bnjlKpdobV8uXlXkKVOJWxm1P

yjQDt1G1FKyBKLmyPbw9xY5DSDmQFpwgeZIQdOkRrrYzwYzYFCuqL9USjPw6414kYqBNr221SWei

pLjbAgMBAAEwDQYJKoZIhvcNAQEFBQADggEBAILQ69plSMdO8/3nx5ZJPMWSS2MqFlThAoMW0kmK

20DBH5o3b+6BZ4d566IEGRReOOFVxMKNbuq3thrIliUQG0Qzzu0T41UE7noFXwZOwavYxhy1BdwW

B906CAb0Qq7qu1FXd8PVKzLn7IazaPXSuRkhGmoE4vcRVphRZkzU6xjkfEZ5AO+7qVE/5tcREXAB

coxpqWeTVeZiT0oazx7eWyqVlqSaLboOqByk5O921hY4E7PZaS7HGBXHcywVHU9fXwbEIgNl0noC

sduXcYkjC6WEiV8rQiuBXx5bspPkau28V+GQ1kNwuq5ypEskDW3GHUrZiAmaucooahVzvhDiBM0=

  </ds:X509Certificate>

  </ds:X509Data>

 </ds:KeyInfo>

 <xenc:CipherData xmlns:xenc="http://www.w3.org/2001/04/xmlenc#">

  <xenc:CipherValue>
LhIn8/SjXbnCsMP6ITxb++0rFYpN8S0L6K/VE74XKjh4Jtlo8IaZQi6c9HRqlII/VT5OKaVySNCO2wOaKS/EUsTt5a/0oR9Yh9mCLt9NQDpkxau1OiydwTYoo6G29fFpYgeDXEPrdR4iUlOERuulmFlNTETWu/doHb4b6hFZdsLEtQH1qSi/jBIq2Q7peXI396G8RWDoWO1urJtIQWR5HjqDckcp3eQ2AC3mXkm949g+OS3Y3g/dPi5erkAhNmFXdinOnX6SQWHEBhFkroFfzqkzEPOVlJdL5Rb9X1mgEk5tJefSUChs6HguRqMeMr0s4UFi/KUwlZbINio1hSNTZg==

  </xenc:CipherValue>

 </xenc:CipherData>

 <xenc:ReferenceList>

  <xenc:DataReference URI="#_a04f85fb05fda175a5e7eba026640f16" />

 </xenc:ReferenceList>

 </xenc:EncryptedKey>

</saml2:EncryptedAssertion>

</saml2p:Response>

However, a colleague from another team has informed us that it is possible
to hide the X509 certificate from a SAML token, or replace the X509
certificate information with a "KeyName". Is it possible to configure the
opensaml implementation to make this happen?

Thanks in advance for the help.

Kind regards,
Ben Green
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130606/3eb7b33f/attachment-0001.html 