EncryptedID in attribute

[Paul Boekholt]

I'm trying to talk to an IDP that's sending an attribute (the
"SectorID") in an EncryptedID element
(ArtifactResponse/Response/Assertion/Advice/Assertion/AttributeStatement/Attribute/AttributeValue/EncryptedID).

After decryption the EncryptedID should have a NameID, see
https://afsprakenstelsel.etoegang.nl/display/as/SAML+encryption for an
explanation and some examples. I want to use the NameID as REMOTE_USER
variable or at least make it available for my application.

I can add the SectorID to my attribute-map but the only
AttributeDecoder that seems to do anything is the XML AttributeDecoder
and it only gives me the child XML elements in base64.  I know
Shibboleth can decode EncryptedID's when they're in
ArtifactResponse/Response/Assertion/Subject, this is done in
SAML2Consumer::implementProtocol(). But I can't find an
AttributeDecoder that can do do the same. Is this possible in
Shibboleth 2.5.3?


Paul Boekholt
Patiënt1