encrypt assertion with static AES key

[Brent Putman]

On 4/10/25 2:04 PM, Cantor, Scott via users wrote:
>
> Doing that with a symmetric key is called key wrapping, and it's in the spec. I think OpenSAML has support for it, but I doubt we have any of the wiring done to permit it since it's insane in this context.


We definitely support symmetric key wrap and those things from the XML 
Encryption spec.

In the IdP what you'd need then is support for building a Credential 
with the key on disk, and I seem to remember implementing something 
like that, i.e. reading the base64-encoded bits of a symmetric key. Not 
100% sure though. Paul, if you really want to try and support it with 
that SP, I can look to confirm that.

For the record this would be the first SP I've personally heard of 
requiring (or even supporting!) use of symmetric key wrap vs public key.


>> BTW, in order to shame the guilty the product in question is
>> Blue from Explorance. Interestingly, we already had a
>> perfectly functional integration with them, but they're
>> "upgrading" their SAML support, and we're running into this
>> issue trying to stand up their dev platform...
> It's Explorant I think, OSU uses it. They used Shibboleth, so of course this will be a drastic improvement, but at least they don't have to use my horrible code anymore.


GU also uses Explorance Blue. I wasn't involved in the SAML setup, 
however, and haven't heard if we are being asked to re-configure things 
yet.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20250410/e521dd1b/attachment.htm>