EncryptedID in attribute

[Peter Schober]

* Paul Boekholt <pboekholt at patient1.nl> [2016-06-22 15:12]:
> I'm trying to talk to an IDP that's sending an attribute (the
> "SectorID") in an EncryptedID element
> (ArtifactResponse/Response/Assertion/Advice/Assertion/AttributeStatement/Attribute/AttributeValue/EncryptedID).

Encrypting the NameID, i.e., creating an EncryptedID element, would
(again) create a direct child element of the Assertion's Subject,
AFAIU, not as part of an AttributeValue in the AttributeStatement.

Encrypting a SAML *attribute* would lead to an EncryptedAttribute, not
an EncryptedID. So the above seems weird to me.
(Without attribute-level or NameID-level encryption in the picture
that's not unheard of, eduPersonTargetedId is a SAML attribute with a
NameID as its AttributeValue.)

> I can add the SectorID to my attribute-map but the only
> AttributeDecoder that seems to do anything is the XML
> AttributeDecoder and it only gives me the child XML elements in
> base64.

Did you try a NameIDAttributeDecoder with the right name attribute?

> I know Shibboleth can decode EncryptedID's when they're in
> ArtifactResponse/Response/Assertion/Subject

That's what I suspect, as per above.

> But I can't find an AttributeDecoder that can do do the same. Is
> this possible in Shibboleth 2.5.3?

Sorry, no idea whether the XML makes any sense, nor whether you can
make the SP process that as you'd like it to (decrypting an
EncryptedID when found as an ordinary attribute value).
-peter