XMLSecurity exception

[Cantor, Scott]

On 3/31/14, 2:51 PM, "Dewberry, James" <JDewberry at nfp.com> wrote:
>
>But that did not fix the problem. We are now getting this error:
>2014-03-31 13:28:18 WARN XMLTooling.Decrypter [33]: XMLSecurity exception
>while decrypting key: OpenSSL:RSA privateKeyDecrypt - Error Decrypting
>PKCS1_5 padded RSA encrypt

As long as it's not mentioning the algorithm being blacklisted anymore, I
would assume your change took effect, so that means they're encrypting
with the wrong key.

>I¹m 99% sure their assertions have not changed. Only the SP version has
>changed.

Well, I can't prove you wrong, all I can say is that the error means your
key changed or they had the wrong to start with, presumably the latter.

If you built a new server with a new SP, that's going to generate a new
key, and you obviously need to copy over the old keypair or this is
exactly what you'd get.

>1. What does that error message mean?
>2. Is there anything I can do to configure Shibboleth here?

Not that I know of

If you want to create a dummy key for them to encrypt with and provide a
sample that won't decrypt and provide the private key in a bug report, it
can certainly be looked at.

>3. We might need to revert back to 2.4.3 temporarily. I saw where I can
>get the Shibboleth archive, but it doesn¹t have the archived
>dependencies. We moved to a new server, but the old server has been
>preserved. Is there a folder on the old server that would
> have correct dependency versions that we could copy?

I don't know which dependencies you mean, but everything has been archived
that I'm aware of, including RPM packages and the Windows installers. The
Mac port might be a problem I guess.

-- Scott