multiple SPs - XMLSecurity exception while decrypting key: OpenSSL:RSA privateKeyDecrypt - Error removing OAEPadding

[Sacha Varma]

Hi Scott & co,

I'm having some trouble configuring two SPs in one Shibboleth configuration.

The error in the browser is:

A valid authentication statement was not found in the incoming message.

The specific errors in shibd.log (with XMLTooling logging set to DEBUG) are:

2022-03-16 06:31:03 WARN XMLTooling.Decrypter [2] [default]: XMLSecurity 
exception while decrypting key: OpenSSL:RSA privateKeyDecrypt - Error 
removing OAEPadding
2022-03-16 06:31:03 WARN XMLTooling.Decrypter [2] [default]: unable to 
decrypt key, generating random key for defensive purposes
2022-03-16 06:31:03 ERROR Shibboleth.SSO.SAML2 [2] [default]: failed to 
decrypt assertion: XMLSecurity exception while decrypting: 
OpenSSL:SymmetricKey::decryptFinish - Out of range padding value in 
final block
2022-03-16 06:31:03 WARN Shibboleth.SSO.SAML2 [2] [default]: error 
processing incoming assertion: A valid authentication statement was not 
found in the incoming message.



I'm using Shibboleth SP Version 3.3.0 on an Amazon Linux server with Apache.

I have two SPs, A and B. (B is a test version of A.)

Each is served on a different domain on the same server (i.e. there are 
two Apache VirtualHosts). Shibboleth protects the whole application, 
i.e. it's not path-based SSO, it's whole domain SSO.

Each has its own entityID (mainly as an attempt to resolve this issue).

Each has its own IdP.

Each IdP requires its own set of signing & encryption certificates.

Each certificate has a distinct Subject CN (i.e. 4 certificates, 4 
different CNs).

I have no control over the IdP, the requirement for distinct 
certificates, or the certificates themselves.

When one SP is configured in isolation, i.e. Shibboleth is set up only 
for A or only for B, everything works for that SP without issue. (So, 
there is no inherent issue with the certificates or their keys or the 
cryptography generally.)

The error occurs when A is configured as the default application and B 
is configured via an ApplicationOverride, and I attempt to access B. A 
works fine.

In A's VirtualHost I have

         AuthType shibboleth
         Require shibboleth
         ShibRequestSetting requireSession true

In B's I have:

         AuthType shibboleth
         Require shibboleth
         ShibRequestSetting requireSession true
         ShibRequestSetting applicationId <name of override>
         ShibRequestSetting entityId <IdP B's entityID>

If I change the applicationId to a non-existent name, I get a 
distinctive error. So, I believe it is a) successfully reading the 
configured ApplicationOverride, and b) mapping my B requests to it.

In the ApplicationOverride, the only things I override are the entityID 
and the CredentialResolvers to supply the signing and encryption 
certificates required by IdP B.

(In case it gives a hint as to what I've misconfigured - I had B's 
MetadataProvider in the ApplicationOverride, but that caused the 
following to be spat out into shibd.log: "no metadata found, can't 
establish identity of issuer". This went away when I moved the 
MetadataProvider to the ApplicationDefaults alongside A's.)

If I comment out B's signing CredentialResolver I get a different error. 
So it is at least using this CredentialResolver from the override.

If I comment out B's encryption CredentialResolver I get the original 
error.

If I copy A's encryption CredentialResolver in place of B's in the 
ApplicationOverride I get the same error.

So, my best guess as to what is happening is that shibd is using the 
overridden signing certificate but not the overridden encryption 
certificate.


I've seen the wiki page on Multiple Credentials:

https://shibboleth.atlassian.net/wiki/spaces/SP3/pages/2067398968/Multiple+Credentials

I have tried adding a RelyingParty in the ApplicationOverride, using a 
locally chosen keyName (as per the final example) since the signing and 
encryption certificates have different Subject CNs.

If I add the keyName only to the encryption CredentialResolver, I get an 
error in shibd.log about not finding the signing credential, and then an 
error from the IdP.

If I add the keyName to both the signing and encryption 
CredentialResolvers, I get an error "XMLSecurity exception while 
decrypting key: OpenSSL:RSA privateKeyDecrypt - Error doing raw decrypt 
of RSA encrypted data" which I would guess to mean it's not using B's 
encryption resolver.

I then tried wrapping the two CredentialResolvers in a chaining 
resolver, and set the keyName on that, but that didn't work. (The error 
was that it couldn't find a signing resolver.)

My final attempt was to remove the RelyingParty and wrap both A and B's 
CredentialResolvers in a chaining resolver, in an attempt to force each 
pair to be explicitly coupled, but that still gives me my original error.


I think I've run out of things to try with my limited understanding - 
I've either made a dumb misconfiguration or my particular scenario is 
not supported.

Any pointers on where to go next?

Thanks,

Sacha.