encrypt assertion with static AES key

[Cantor, Scott]

> As far as I can tell, there is no definition in the SAML spec for
> using a hardcoded AES key?

SAML doesn't address any of that, XML Encryption does. You never directly encrypt any data with a fixed key of any type, you generate a key to encrypt with and it's the data encryption key that's encrypted in the public or shared key.

Doing that with a symmetric key is called key wrapping, and it's in the spec. I think OpenSAML has support for it, but I doubt we have any of the wiring done to permit it since it's insane in this context.

But defined, more or less, yes.

> Am I missing something? Even if I did want to try
> and do this, which obviously I don't, there's no way to
> actually configure it?

It's unlikely it's impossible to configure given enough work if the library supports it, in that Spring doesn't really do anything but directly wire up the objects to begin with.

> BTW, in order to shame the guilty the product in question is
> Blue from Explorance. Interestingly, we already had a
> perfectly functional integration with them, but they're
> "upgrading" their SAML support, and we're running into this
> issue trying to stand up their dev platform...

It's Explorant I think, OSU uses it. They used Shibboleth, so of course this will be a drastic improvement, but at least they don't have to use my horrible code anymore.

-- Scott