Error encrypting?

David Gersic dgersic at niu.edu
Fri Jun 27 10:07:17 EDT 2014 

I'm working with a new vendor here that we've not worked with before. I'm running the IdP, and don't know much about the SP side of things. The SP is SimpleSAMLphp.  On the IdP, I see auth succeed, then a Java belch complaining about encryption.

Is this something I need to fix on my end, or is this a problem for the SP to fix? Google suggests that this is an error in the published metadata (via InCommon) but while the symptoms seem to match, the posted metadata excerpts don't seem to, so I'm not sure if I've found something relevant or something unrelated that has the same symptoms.


12:53:19.248 - INFO [edu.vt.middleware.ldap.jaas.JaasAuthenticator:176] - Authentication succeeded for dn: uid=xxxxxxxxxx,ou=people,dc=niu,dc=edu
12:53:19.319 - INFO [Shibboleth-Access:74] - 20140626T175319Z|192.41.76.4|idp.niu.edu:443|/profile/SAML2/Redirect/SSO|
12:53:19.437 - ERROR [org.opensaml.xml.encryption.Encrypter:349] - Error encrypting element on key encryption
org.apache.xml.security.encryption.XMLEncryptionException: Illegal key size or default parameters
        at org.apache.xml.security.encryption.XMLCipher.encryptKey(Unknown Source) ~[xmlsec-1.4.5.jar:na]
        at org.opensaml.xml.encryption.Encrypter.encryptKey(Encrypter.java:345) [xmltooling-1.3.3.jar:na]
        at org.opensaml.xml.encryption.Encrypter.encryptKey(Encrypter.java:286) [xmltooling-1.3.3.jar:na]
        at org.opensaml.xml.encryption.Encrypter.encryptKey(Encrypter.java:262) [xmltooling-1.3.3.jar:na]
        at org.opensaml.saml2.encryption.Encrypter.encrypt(Encrypter.java:358) [opensaml-2.5.2.jar:na]
        at org.opensaml.saml2.encryption.Encrypter.encrypt(Encrypter.java:258) [opensaml-2.5.2.jar:na]
        at edu.internet2.middleware.shibboleth.idp.profile.saml2.AbstractSAML2ProfileHandler.buildResponse(AbstractSAML2ProfileHandler.java:287) [shibboleth-identityprovider-2.3.5.jar:na]
        at edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.completeAuthenticationRequest(SSOProfileHandler.java:283) [shibboleth-identityprovider-2.3.5.jar:na]
        at edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.processRequest(SSOProfileHandler.java:165) [shibboleth-identityprovider-2.3.5.jar:na]
        at edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.processRequest(SSOProfileHandler.java:88) [shibboleth-identityprovider-2.3.5.jar:na]
        at edu.internet2.middleware.shibboleth.common.profile.ProfileRequestDispatcherServlet.service(ProfileRequestDispatcherServlet.java:84) [shibboleth-common-1.3.4.jar:na]
        at javax.servlet.http.HttpServlet.service(HttpServlet.java:717) [servlet-api.jar:na]
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290) [catalina.jar:6.0.35]
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) [catalina.jar:6.0.35]
        at edu.internet2.middleware.shibboleth.idp.util.NoCacheFilter.doFilter(NoCacheFilter.java:50) [shibboleth-identityprovider-2.3.5.jar:na]
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235) [catalina.jar:6.0.35]
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) [catalina.jar:6.0.35]
        at edu.internet2.middleware.shibboleth.idp.session.IdPSessionFilter.doFilter(IdPSessionFilter.java:81) [shibboleth-identityprovider-2.3.5.jar:na]
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235) [catalina.jar:6.0.35]
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) [catalina.jar:6.0.35]
        at edu.internet2.middleware.shibboleth.common.log.SLF4JMDCCleanupFilter.doFilter(SLF4JMDCCleanupFilter.java:52) [shibboleth-common-1.3.4.jar:na]
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235) [catalina.jar:6.0.35]
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) [catalina.jar:6.0.35]
        at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:219) [catalina.jar:6.0.35]
        at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:191) [catalina.jar:6.0.35]
        at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:127) [catalina.jar:6.0.35]
        at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102) [catalina.jar:6.0.35]
        at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109) [catalina.jar:6.0.35]
        at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:293) [catalina.jar:6.0.35]
        at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:859) [tomcat-coyote.jar:6.0.35]
        at org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process(Http11Protocol.java:602) [tomcat-coyote.jar:6.0.35]
        at org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:489) [tomcat-coyote.jar:6.0.35]
        at java.lang.Thread.run(Thread.java:738) [na:1.6.0]
12:53:19.441 - ERROR [edu.internet2.middleware.shibboleth.idp.profile.saml2.AbstractSAML2ProfileHandler:294] - Unable to encrypt assertion
org.opensaml.xml.encryption.EncryptionException: Error encrypting element on key encryption
        at org.opensaml.xml.encryption.Encrypter.encryptKey(Encrypter.java:350) ~[xmltooling-1.3.3.jar:na]
        at org.opensaml.xml.encryption.Encrypter.encryptKey(Encrypter.java:286) ~[xmltooling-1.3.3.jar:na]
        at org.opensaml.xml.encryption.Encrypter.encryptKey(Encrypter.java:262) ~[xmltooling-1.3.3.jar:na]
        at org.opensaml.saml2.encryption.Encrypter.encrypt(Encrypter.java:358) ~[opensaml-2.5.2.jar:na]
        at org.opensaml.saml2.encryption.Encrypter.encrypt(Encrypter.java:258) ~[opensaml-2.5.2.jar:na]
        at edu.internet2.middleware.shibboleth.idp.profile.saml2.AbstractSAML2ProfileHandler.buildResponse(AbstractSAML2ProfileHandler.java:287) ~[shibboleth-identityprovider-2.3.5.jar:na]
        at edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.completeAuthenticationRequest(SSOProfileHandler.java:283) [shibboleth-identityprovider-2.3.5.jar:na]
        at edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.processRequest(SSOProfileHandler.java:165) [shibboleth-identityprovider-2.3.5.jar:na]
        at edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.processRequest(SSOProfileHandler.java:88) [shibboleth-identityprovider-2.3.5.jar:na]
        at edu.internet2.middleware.shibboleth.common.profile.ProfileRequestDispatcherServlet.service(ProfileRequestDispatcherServlet.java:84) [shibboleth-common-1.3.4.jar:na]
        at javax.servlet.http.HttpServlet.service(HttpServlet.java:717) [servlet-api.jar:na]
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290) [catalina.jar:6.0.35]
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) [catalina.jar:6.0.35]
        at edu.internet2.middleware.shibboleth.idp.util.NoCacheFilter.doFilter(NoCacheFilter.java:50) [shibboleth-identityprovider-2.3.5.jar:na]
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235) [catalina.jar:6.0.35]
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) [catalina.jar:6.0.35]
        at edu.internet2.middleware.shibboleth.idp.session.IdPSessionFilter.doFilter(IdPSessionFilter.java:81) [shibboleth-identityprovider-2.3.5.jar:na]
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235) [catalina.jar:6.0.35]
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) [catalina.jar:6.0.35]
        at edu.internet2.middleware.shibboleth.common.log.SLF4JMDCCleanupFilter.doFilter(SLF4JMDCCleanupFilter.java:52) [shibboleth-common-1.3.4.jar:na]
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235) [catalina.jar:6.0.35]
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) [catalina.jar:6.0.35]
        at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:219) [catalina.jar:6.0.35]
        at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:191) [catalina.jar:6.0.35]
        at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:127) [catalina.jar:6.0.35]
        at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102) [catalina.jar:6.0.35]
        at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109) [catalina.jar:6.0.35]
        at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:293) [catalina.jar:6.0.35]
        at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:859) [tomcat-coyote.jar:6.0.35]
        at org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process(Http11Protocol.java:602) [tomcat-coyote.jar:6.0.35]
        at org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:489) [tomcat-coyote.jar:6.0.35]
        at java.lang.Thread.run(Thread.java:738) [na:1.6.0]
Caused by: org.apache.xml.security.encryption.XMLEncryptionException: Illegal key size or default parameters
        at org.apache.xml.security.encryption.XMLCipher.encryptKey(Unknown Source) ~[xmlsec-1.4.5.jar:na]
        at org.opensaml.xml.encryption.Encrypter.encryptKey(Encrypter.java:345) ~[xmltooling-1.3.3.jar:na]
        ... 31 common frames omitted

More information about the users mailing list