Spring-Security-SAML & test-shib, Unable to encrypt assertion

[Dan Turner]

Hi all,

I'm trying to integrate Spring Security SAML into our product for
Shibboleth SSO, and I'm bumping my head against an issue which I can't
seem to pin down.

I am running a test system, with metadata registered at testshib.org,
and attempting a login. The redirect to testshib works as expected,
testshib accepts the myself:myself credential and attempts to encrypt
the assertions for return to our system, however, at this point it
falls over, with an Unable to encrypt assertion status message turning
up in our system's logs. From testshib's public logs:

07:42:38.812 - ERROR
[edu.internet2.middleware.shibboleth.idp.profile.saml2.AbstractSAML2ProfileHandler:927]
- Could not resolve a key encryption credential for peer entity:
https://sforge0.york.ac.uk/sf/saml/
07:42:38.812 - ERROR
[edu.internet2.middleware.shibboleth.idp.profile.saml2.AbstractSAML2ProfileHandler:289]
- Unable to construct encrypter
org.opensaml.xml.security.SecurityException: Could not resolve key
encryption credential
	at
edu.internet2.middleware.shibboleth.idp.profile.saml2.AbstractSAML2ProfileHandler.getEncrypter(AbstractSAML2ProfileHandler.java:928)
~[shibboleth-identityprovider-2.4.0.jar:na]
	at ... [truncated]

I believe that I have the correct metadata, but clearly, this is not
the case. As per other (older) questions, and the shibboleth.net wiki,
I have ensured that the metadata has the namespace for KeyDescriptors,
and both use="encryption" and use="signing":

<?xml version="1.0" encoding="UTF-8"?>
<md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
ID="https___sforge0.york.ac.uk_sf_saml"
entityID="https://sforge0.york.ac.uk/sf/saml">
  <md:SPSSODescriptor AuthnRequestsSigned="true"
WantAssertionsSigned="true"
protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
    <md:KeyDescriptor use="signing">
      <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
        <ds:X509Data>
          <ds:X509Certificate>MIIDNj... [snip] ...</ds:X509Certificate>
        </ds:X509Data>
      </ds:KeyInfo>
    </md:KeyDescriptor>
    <md:KeyDescriptor use="encryption">
      <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
        <ds:X509Data>
          <ds:X509Certificate>MIIDNjCC... [snip] ...</ds:X509Certificate>
        </ds:X509Data>
      </ds:KeyInfo>
    </md:KeyDescriptor>
    <md:SingleLogoutService
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
Location="https://sforge0.york.ac.uk:443/sf/saml/SingleLogout"/>
    <md:SingleLogoutService
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"
Location="https://sforge0.york.ac.uk:443/sf/saml/SingleLogout"/>

<md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</md:NameIDFormat>

<md:NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</md:NameIDFormat>

<md:NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:persistent</md:NameIDFormat>

<md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</md:NameIDFormat>

<md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName</md:NameIDFormat>
    <md:AssertionConsumerService
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
Location="https://sforge0.york.ac.uk:443/sf/saml/SSO" index="0"
isDefault="true"/>
  </md:SPSSODescriptor>
</md:EntityDescriptor>

For the purposes of testing, I am providing the same key for both
encryption and signing (I know, _really_ bad from a sec. stand point,
will be corrected in production).

Each time that I upload the metadata to testshib.org, I manually
inspect it to check that it appears correct (e.g. has KeyDescriptor,
correct namespaces, etc.), but obviously, I'm missing something here.

Regards,

Dan Turner