SP cannot decrypt EncryptedAssertion responses

[Matthew X. Economou]

Would you please help me with what might be a Shibboleth SP
configuration issue?

When logging into a Shibboleth 2.5.6 service provider using an AD FS 2.0
identity provider, I get the following error after successfully
authenticating to the IdP and being posted back to the SP:

```
opensaml::FatalProfileException at
(https://.../Shibboleth.sso/SAML2/POST)
A valid authentication statement was not found in the incoming message.
```

The following gets logged to shibd.log:

```
DEBUG XMLTooling.CredentialCriteria [3]: key algorithm didn't match
('AES' != 'RSA')
WARN XMLTooling.Decrypter [3]: XMLSecurity exception while decrypting
key: OpenSSL:RSA privateKeyDecrypt - Error removing OAEPadding
WARN XMLTooling.Decrypter [3]: unable to decrypt key, generating random
key for defensive purposes
ERROR Shibboleth.SSO.SAML2 [3]: failed to decrypt assertion: XMLSecurity
exception while decrypting: OpenSSL:SymmetricKey::decryptFinish - Out of
range padding value in final block
```

I suspect that this is a configuration error on my part, but I can't
figure out what I did wrong.  The correct keying material (and other
metadata) is loaded on both systems.  (Each entity uses the same
key-pair for both signing and encryption.)  I confirmed this by using
SAMLParser to decrypt the EncryptedAssertion response.

In the SP configuration, the credential `use` isn't set, so it looks
something like `<CredentialResolver type="File" key="sp-key.pem"
certificate="sp-cert.pem"/>`, which I assumed uses the same key-pair for
both signing and encryption.  If I change the credential resolver
configuration such that I have two references to the same key pair, one
with `use="signing"` and the other with `use="encryption"`, the
following also gets logged to shibd.log:

```
DEBUG XMLTooling.CredentialCriteria [1]: usage didn't match (4 != 3)
```

The assertion is encrypted using
"http://www.w3.org/2001/04/xmlenc#aes256-cbc".  The symmetric key is
encrypted using "http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p" and
signed using "http://www.w3.org/2000/09/xmldsig#sha1".  I posted an
abbreviated version of the response to
https://gist.github.com/xenophonf/d502321a61e287021ba9, in case that
might help debugging.

Of course, as a workaround I can delete the encryption certificate from
the RP trust in AD FS, which forces it to sign SAML responses only, but
I would really rather encrypt responses to my SP.

Thanks in advance for any help you can provide!

Best wishes,
Matthew

-- 
"The lyf so short, the craft so longe to learne."