XMLSecurity exception

[Dewberry, James]

Hi folks!

We upgraded our Service Provider from version 2.4.3 to 2.5.3, and we’ve run into a problem that I can’t figure out.

We talk to 3 IdPs successfully, but 1 is having a problem getting their assertions decrypted.

I saw this in the log:
2014-03-26 22:07:03 WARN XMLTooling.Decrypter [1]: XMLSecurity exception while decrypting key: XSECAlgorithmMapper::mapURIToHandler - URI http://www.w3.org/2001/04/xmlenc#rsa-1_5 disallowed by whitelist/blacklist policy
2014-03-26 22:07:03 WARN XMLTooling.Decrypter [1]: unable to decrypt key, generating random key for defensive purposes
2014-03-26 22:07:03 ERROR Shibboleth.SSO.SAML2 [1]: failed to decrypt assertion: XMLSecurity exception while decrypting: OpenSSL:SymmetricKey::decryptFinish - Out of range padding value in final block

And when I look in their assertion I see:
<xenc:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-1_5”/>

So I figured that they are using an encryption method that was blacklisted in version 2.5.1. We have a business reason for letting them come in using that encryption temporarily, even though it’s not the most secure.

So I added this to the security policy:
<AlgorithmBlacklist includeDefaultBlacklist="false”/>

I also added this to the environment because it applies to us:
export LD_LIBRARY_PATH=/opt/shibboleth/lib64

But that did not fix the problem. We are now getting this error:
2014-03-31 13:28:18 WARN XMLTooling.Decrypter [33]: XMLSecurity exception while decrypting key: OpenSSL:RSA privateKeyDecrypt - Error Decrypting PKCS1_5 padded RSA encrypt
2014-03-31 13:28:18 WARN XMLTooling.Decrypter [33]: unable to decrypt key, generating random key for defensive purposes
2014-03-31 13:28:18 ERROR Shibboleth.SSO.SAML2 [33]: failed to decrypt assertion: XMLSecurity exception while decrypting: Errors occured during de-serialisation of decrypted element content

I’m 99% sure their assertions have not changed. Only the SP version has changed.

So…

  1.  What does that error message mean?
  2.  Is there anything I can do to configure Shibboleth here?
  3.  We might need to revert back to 2.4.3 temporarily. I saw where I can get the Shibboleth archive, but it doesn’t have the archived dependencies. We moved to a new server, but the old server has been preserved. Is there a folder on the old server that would have correct dependency versions that we could copy?

Thanks so much for your help,
Jim


**********************************************************************
This e-mail may contain information that is privileged, confidential or protected under state or federal law. If you are not an intended recipient of this email, please delete it, notify the sender immediately, and do not copy, use or disseminate any information in the e-mail. Pursuant to IRS Circular 230, any tax advice in this email may not be used to avoid any penalties imposed under U.S. tax laws. E-mail sent to or from this e-mail address may be monitored, reviewed and archived.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20140331/890aadfd/attachment-0001.html