Encrypting the IdPs assertion to an SP

[Brent Putman]

On 10/29/15 8:11 PM, IAM David Bantz wrote:
> Attempting integration between my IdP and a Salesforce application
> (SP).  First attempt failed with the message:
>
> 11:40:34.793 - ERROR
> [edu.internet2.middleware.shibboleth.idp.profile.saml2.AbstractSAML2ProfileHandler:927]
> - Could not resolve a key encryption credential for peer
> entity: https://....force.com
> 11:40:34.793 - ERROR
> [edu.internet2.middleware.shibboleth.idp.profile.saml2.AbstractSAML2ProfileHandler:289]
> - Unable to construct encrypter
> org.opensaml.xml.security.SecurityException: Could not resolve key
> encryption credential.
>
> I can disable encryption to this SP in relying-party.xml for now but
> it highlighted my lack of understanding: There is a certificate in
> this SP's metadata; why wasn't it used to encrypt the assertion. 
> Decoded certificate indicates key usage for "Digital Signature, Key
> Encipherment"
>

The cert key usage data has nothing to do with it, the IdP doesn't even
look at it. The cert in the SP's metadata isn't resolvable for
encryption, mostly likely because its KeyDescriptor has use="signing". 
You'd want to either remove the 'use' attribute, or add a new
KeyDescriptor with the same or another cert, and marked with
use="encryption"

More esoteric: If the SP cert has a DSA key, rather then RSA, that
fundamentally isn't usable for encryption period, so won't be resolved
even if it's (non-nonsensically) marked with use="encryption".


> The service provider subsequently sent the following message:
> "When Salesforce is the service provider for inbound SAML assertions,
> you can pick a saved certificate to decrypt inbound assertions from
> third party identity providers. You need to provide a copy of this
> certificate to the identity provider.
>
> I've haven't previously received a separate key for encrypting
> assertions. What do I do with it??
>

Whichever one you pick from Salesforce, it needs to be in the IdP's copy
of the SP's metadata, and its KeyDescriptor either marked with
use="encryption", or 'use' omitted entirely if you want to use the same
cert/key for both.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20151029/52a3067f/attachment.html>