[EXTERNAL] Multiple entity-id:s for SP-half of IdP?

[Tomas Stenlund]

Hi,

thanks for the pointer, and yes the issuer changed in the AuthnRequest 
when I changed the property you suggested. The request was then sent to 
the upstream IdP and it responded as expected. But when the 
EncryptedAssertion came back the proxy failed to decrypt it.

2024-04-03 10:30:17,773 - 172.234.96.182 - DEBUG 
[org.apache.xml.security.signature.Reference:799] - Verification 
successful for URI "#_10f331ec703a73289653d99c248f3045"
2024-04-03 10:30:17,773 - 172.234.96.182 - DEBUG 
[org.apache.xml.security.signature.Manifest:341] - The Reference has Type
2024-04-03 10:30:17,783 - 172.234.96.182 - ERROR 
[org.opensaml.xmlsec.encryption.support.Decrypter:605] - Failed to 
decrypt EncryptedData using either EncryptedData 
KeyInfoCredentialResolver or EncryptedKeyResolver + EncryptedKey 
KeyInfoCredentialResolver
2024-04-03 10:30:17,783 - 172.234.96.182 - ERROR 
[org.opensaml.saml.saml2.encryption.Decrypter:182] - SAML Decrypter 
encountered an error decrypting element content: Failed to decrypt 
EncryptedData
2024-04-03 10:30:17,783 - 172.234.96.182 - WARN 
[org.opensaml.saml.saml2.profile.impl.DecryptAssertions:71] - Profile 
Action DecryptAssertions: Failure performing decryption

So, the relying party override looks like this:

         <bean parent="RelyingPartyByTag">
             <constructor-arg name="candidates">
                 <list>
                     <bean parent="TagCandidate" 
c:name="http://macedir.org/entity-category"
p:values="http://id.swedenconnect.se/contract/sc/prepaid-auth-2021"/>
                 </list>
             </constructor-arg>
             <property name="profileConfigurations">
                 <list>
                     <bean parent="SAML2.SSO" p:encryptAssertions="true" 
p:signAssertions="true" p:signRequests="true" p:forceAuthn="true" 
p:checkAddress="false"/>
                     <bean parent="SAML2.Logout" p:encryptNameIDs="false"/>
                 </list>
             </property>

             <property name="issuer" 
value="https://nereid.stenlund.eu/idp"/>

         </bean>

It works when not setting the issuer. The two SP-metadata registered at 
the upstream IdP uses the same certificates. So i guess I am missing 
something that points my proxy to the correct key due to the changed 
issuer or I have failed misreably at comparing the two sp-metadatas.

  The EncryptedAssertion when it comes back contains this and the 
recipient points to the issuer I sent upstream.

                  <xenc:EncryptedKey 
Id="_92df7fd14d0379c8bb99436fa46ff2f6" 
Recipient="https://nereid.stenlund.eu/idp" 
xmlns:xenc="http://www.w3.org/2001/04/xmlenc#">
                     <xenc:EncryptionMethod 
Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p" 
xmlns:xenc="http://www.w3.org/2001/04/xmlenc#">
                         <ds:DigestMethod 
Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" 
xmlns:ds="http://www.w3.org/2000/09/xmldsig#"/>
                     </xenc:EncryptionMethod>
                     <ds:KeyInfo>
                         <ds:X509Data>
                             <ds:X509Certificate>...redacted for 
space...</ds:X509Certificate>
                         </ds:X509Data>
                     </ds:KeyInfo>
                     <xenc:CipherData 
xmlns:xenc="http://www.w3.org/2001/04/xmlenc#">
                         <xenc:CipherValue>...redacted for 
space...</xenc:CipherValue>
                     </xenc:CipherData>
                 </xenc:EncryptedKey>

Any pointers?

Thanks,

Tomas

On 2024-04-01 16:11, Cantor, Scott via users wrote:
>> I'd like to know this as well. There is nothing documented on how
>> this is accomplished, only that its possible for the entityID of the SP
>> half to be overridden if required...
> It's the same way you override the entityID in other cases, it's a relying party setting.
>
> The name of the property was aliased from responderId to issuer to address the naming confusion in 5.x, it's responderId only in 4.x.
>
> http://shibboleth.net/api/java-shib-profile/5.1.1//net/shibboleth/profile/relyingparty/RelyingPartyConfiguration.html
>
> -- Scott
>
>