algorithm URI was invalid: http://www.w3.org/2001/04/xmlenc#aes128-cbc

[Brent Putman]

On 9/26/13 9:09 AM, Joy Veronneau wrote:
>
> 13:24:03.463 - ERROR [org.opensaml.xml.encryption.Encrypter:649] - Could not generate encryption key, algorithm URI was invalid: http://www.w3.org/2001/04/xmlenc#aes128-cbc
> 13:24:03.467 - ERROR [edu.internet2.middleware.shibboleth.idp.profile.saml2.AbstractSAML2ProfileHandler:294] - Unable to encrypt assertion
> org.opensaml.xml.encryption.EncryptionException: Could not generate encryption key, algorithm URI was invalid: http://www.w3.org/2001/04/xmlenc#aes128-cbc

Tracing down the exact code path implied by the above, I *think* what is
happening is that the Santuario xmlsec method that maps the algorithm
URI to the Java JCA algorithm (e.g. "AES") is returning null:

JCEMapper.getJCEKeyAlgorithmFromURI(algorithmURI)

In the log just above what you supplied, do you see another line on
level ERROR like:  "Mapping from algorithm URI ..... to key algorithm
not available, key generation failed" ? If so, can you please send that
also, (exactly as it appears)?  Or even if not, if there are any
immediately preceding lines that look relevant, those might be helpful.
 
Looking at their code, I don't offhand know how/why that could happen,
unless either 1) the algorithm URI *maybe* has some extraneous
whitespace or other extraneous character in it that I'm not seeing
above, or 2) Santuario is not properly initialized.

For #1, the only thing I can think of is:  are you by chance using the
newly released custom security config bean to make custom settings for
algorithms, etc?  If so, then either a hard-to-spot typo there in your
actual bean wiring data, or perhaps failure in the code to trim
whitespace or something could mean that the lookup could fail.

For #2, I can't think of how this could be happening while Santurio
usage like XML signing is (presumably) succeeding, so not ideas there yet.


--Brent