Hi All,<div><br></div><div>Our partner (IDP) is making use of encryption when sending assertions to our SP. I am getting errors indicating that an AttributeStatement is present, but contains no attributes. When I look at the actual assertion, I see these inside of the AttributeStatement element:</div>
<div><br></div><div><span class="webkit-html-tag" style="font-family:monospace;font-size:medium;white-space:pre-wrap"><<span style="background-color:rgb(255,255,51)">saml:EncryptedAttribut</span>e></span><span class="webkit-html-tag" style="font-family:monospace;font-size:medium;white-space:pre-wrap"><EncryptedData <span class="webkit-html-attribute-name">xmlns</span>="<span class="webkit-html-attribute-value"><a href="http://www.w3.org/2001/04/xmlenc#">http://www.w3.org/2001/04/xmlenc#</a></span>" <span class="webkit-html-attribute-name">Id</span>="<span class="webkit-html-attribute-value">uuida4ff45ee-0138-1608-b6d3-8f0c9cec183c</span>" <span class="webkit-html-attribute-name">Type</span>="<span class="webkit-html-attribute-value"><a href="http://www.w3.org/2001/04/xmlenc#Element">http://www.w3.org/2001/04/xmlenc#Element</a></span>"></span><span class="webkit-html-tag" style="font-family:monospace;font-size:medium;white-space:pre-wrap"><EncryptionMethod <span class="webkit-html-attribute-name">Algorithm</span>="<span class="webkit-html-attribute-value"><a href="http://www.w3.org/2001/04/xmlenc#aes128-cbc">http://www.w3.org/2001/04/xmlenc#aes128-cbc</a></span>"></span><span class="webkit-html-tag" style="font-family:monospace;font-size:medium;white-space:pre-wrap"></EncryptionMethod></span><span class="webkit-html-tag" style="font-family:monospace;font-size:medium;white-space:pre-wrap"><ds:KeyInfo></span><span class="webkit-html-tag" style="font-family:monospace;font-size:medium;white-space:pre-wrap"><EncryptedKey <span class="webkit-html-attribute-name">Id</span>="<span class="webkit-html-attribute-value">uuida4ff45ef-0138-171b-8a47-8f0c9cec183c</span>"></span><span class="webkit-html-tag" style="font-family:monospace;font-size:medium;white-space:pre-wrap"><EncryptionMethod <span class="webkit-html-attribute-name">Algorithm</span>="<span class="webkit-html-attribute-value"><a href="http://www.w3.org/2001/04/xmlenc#rsa-1_5">http://www.w3.org/2001/04/xmlenc#rsa-1_5</a></span>"></span><span class="webkit-html-tag" style="font-family:monospace;font-size:medium;white-space:pre-wrap"></EncryptionMethod></span><span class="webkit-html-tag" style="font-family:monospace;font-size:medium;white-space:pre-wrap"><ds:KeyInfo></span><span class="webkit-html-tag" style="font-family:monospace;font-size:medium;white-space:pre-wrap"><ds:KeyName></span><span style="font-family:monospace;font-size:medium;white-space:pre-wrap">EMAILADDRESS=<a href="mailto:cloudops@audaxhealth.com">cloudops@audaxhealth.com</a>, CN=<a href="http://www.dev.careverge.com">www.dev.careverge.com</a>, OU=Cloud Ops, O=Audax Health Inc., L=Washington, ST=District of Columbia, C=US</span><span class="webkit-html-tag" style="font-family:monospace;font-size:medium;white-space:pre-wrap"></ds:KeyName></span><span class="webkit-html-tag" style="font-family:monospace;font-size:medium;white-space:pre-wrap"></ds:KeyInfo></span><span class="webkit-html-tag" style="font-family:monospace;font-size:medium;white-space:pre-wrap"><CipherData></span><span class="webkit-html-tag" style="font-family:monospace;font-size:medium;white-space:pre-wrap"><CipherValue></span><span style="font-family:monospace;font-size:medium;white-space:pre-wrap">QUjVNf4g87ESOQqdWc/36NAcjoA3kspLaGNmrKNyYWAuABr4mP2Hx6x/S4qUv7rbmEwqJBrdLuDQf6CmZyuYvN5wFLMNUT/HqSqNZYqb9yvUTD7RNZvP77QcQhdEs4jpTRTRE26Xkus0HgcoV4U1tlaWchkoCwxznz4zf4k3J1VlTt4Rzowatp8zKxJJDiQXXTWFvWX6UdANVtjOgc2IrGn6f9t94EYISvrfYa/ynhy9BbSC8paaEmIovF2vPLTN9PQAT5somM0M60W6iys2UKW3jfxMC8bFilagPU5qGdfNKhc80pqRgwoDqTidhyl3E78hmbTHuzbexWNhCzBZKA==</span><span class="webkit-html-tag" style="font-family:monospace;font-size:medium;white-space:pre-wrap"></CipherValue></span><span class="webkit-html-tag" style="font-family:monospace;font-size:medium;white-space:pre-wrap"></CipherData></span><span class="webkit-html-tag" style="font-family:monospace;font-size:medium;white-space:pre-wrap"></EncryptedKey></span><span class="webkit-html-tag" style="font-family:monospace;font-size:medium;white-space:pre-wrap"></ds:KeyInfo></span><span class="webkit-html-tag" style="font-family:monospace;font-size:medium;white-space:pre-wrap"><CipherData></span><span class="webkit-html-tag" style="font-family:monospace;font-size:medium;white-space:pre-wrap"><CipherValue></span><span style="font-family:monospace;font-size:medium;white-space:pre-wrap">tfZgyTVIab8ofiHezBwK0OJjgUYxcG12YkJGs2Vp1/EhgtvxUemL8OZlVrEV+XswQZM+7aIc509bVx6TYGr5Ru38CLppvSCMDIe8xPDCZY1naIkwzChymVrYxnkFPP1J5SBtfWN8MjgjZ0ftYltRbD3DFmWxaoIVRrbpZ7Lgk5UKaAQd3xp+eUfLNVCIxW7lg44VI9iZ81cUpXKlYYDw8EhIi/xEa+bM5gi1x7RWTSp/Lrs3tU/+wDkiOI+Oqm3h0nuc2Sh/h1gkI5TktTxKTKDpqnBA81zTfdItPybD8g0lZux8Q49zp7KggzNk5ZX+UMlK3jqXH16uqwbETODlzKKByvJyUvUU8ArWZBl0B+TIdOcgo5MFl3Li1vxTI8G80iCayG9ajsySkcOP9YJLTQyXo9sAO6CEZj8LXa3QIb23lzMSHbUCYrZFWpycslmT</span><span class="webkit-html-tag" style="font-family:monospace;font-size:medium;white-space:pre-wrap"></CipherValue></span><span class="webkit-html-tag" style="font-family:monospace;font-size:medium;white-space:pre-wrap"></CipherData></span><span class="webkit-html-tag" style="font-family:monospace;font-size:medium;white-space:pre-wrap"></EncryptedData></span><span class="webkit-html-tag" style="font-family:monospace;font-size:medium;white-space:pre-wrap"></saml:EncryptedAttribute></span></div>
<div><span class="webkit-html-tag" style="font-family:monospace;font-size:medium;white-space:pre-wrap"><br></span></div><div><span class="webkit-html-tag" style="white-space:pre-wrap"><font face="arial, helvetica, sans-serif">So there appear to be attributes, but my SP is unable to decrypt them. From reading the docs, I found that the <AttributeExtractor> will support <saml2:EncryptedAttribute> elements, but I see we are getting <saml:EncryptedAttribute>. Could this be causing us to not properly handle the elements? Also, on ApplicationDefaults, I have encrypted=true (which I think only applies to outbound messages though)</font></span></div>
<div><span class="webkit-html-tag" style="white-space:pre-wrap"><font face="arial, helvetica, sans-serif"><br></font></span></div><div><span class="webkit-html-tag" style="white-space:pre-wrap"><font face="arial, helvetica, sans-serif">Thank you,</font></span></div>
<div><span class="webkit-html-tag" style="white-space:pre-wrap"><font face="arial, helvetica, sans-serif"><br></font></span></div><div><span class="webkit-html-tag" style="white-space:pre-wrap"><font face="arial, helvetica, sans-serif">Rob</font></span></div>
<div><span class="webkit-html-tag" style="white-space:pre-wrap"><font face="arial, helvetica, sans-serif"><br></font></span></div><div><span class="webkit-html-tag" style="white-space:pre-wrap"><font face="arial, helvetica, sans-serif">PS: I would like to add that of all the open source message boards I have used, the shib folks respond the fastest, hands down. Thank you for that.</font></span></div>