I went ahead and ran the assertion through a pretty printer and pulled out the encrypted assertion (below). I see that the assertion data is encrypted with AES, and the AES key itself is encrypted with rsa1.5. What I learned about PKI, I learned about 10 years ago in undergrad so forgive me if the question I ask seems painfully obvious. Is our partner using our public key to encrypt the AES key, which we need to decrypt with our private key and then use that to decrypt the assertion itself? When I look at the logs, it appears that things fall apart when it tries to process "message against SAML 2.0 SSO profile":<div>
<br></div><div>2012-07-24 12:45:57 DEBUG OpenSAML.SecurityPolicyRule.XMLSigning [21]: signature verified against message issuer</div><div>2012-07-24 12:45:57 DEBUG Shibboleth.SSO.SAML2 [21]: processing message against SAML 2.0 SSO profile</div>
<div>2012-07-24 12:45:57 DEBUG XMLTooling.KeyInfoResolver.Inline [21]: resolved 0 certificate(s)</div><div>2012-07-24 12:45:57 DEBUG XMLTooling.CredentialCriteria [21]: key algorithm didn't match ('AES' != 'RSA')</div>
<div>2012-07-24 12:45:57 DEBUG XMLTooling.KeyInfoResolver.Inline [21]: resolved 0 certificate(s)</div><div>2012-07-24 12:45:57 DEBUG XMLTooling.CredentialCriteria [21]: credential name(s) didn't overlap</div><div>2012-07-24 12:45:57 ERROR Shibboleth.SSO.SAML2 [21]: Unable to resolve any key decryption keys.</div>
<div>2012-07-24 12:46:08 INFO Shibboleth.Listener [18]: detected socket closure, shutting down worker thread</div><div>2012-07-24 12:46:38 INFO Shibboleth.Listener [21]: detected socket closure, shutting down worker thread</div>
<div>2012-07-24 12:54:16 DEBUG Shibboleth.Listener [22]: dispatching message (default/Metadata)</div><div><br></div><div>Are we trying to use AES to decrypt something encrypted by RSA inadvertently? <div><br></div><div>
<p class="p1"><saml:EncryptedAssertion></p>
<p class="p1"> <EncryptedData xmlns="<a href="http://www.w3.org/2001/04/xmlenc#">http://www.w3.org/2001/04/xmlenc#</a>" Id="uuidb905a739-0138-1072-949c-ee2b588c9055" Type="<a href="http://www.w3.org/2001/04/xmlenc#Element">http://www.w3.org/2001/04/xmlenc#Element</a>"></p>
<p class="p1"> <EncryptionMethod Algorithm="<a href="http://www.w3.org/2001/04/xmlenc#aes128-cbc">http://www.w3.org/2001/04/xmlenc#aes128-cbc</a>"/></p>
<p class="p1"> <ds:KeyInfo></p>
<p class="p1"> <EncryptedKey Id="uuidb905a73a-0138-1d38-9a0a-ee2b588c9055"></p>
<p class="p1"> <EncryptionMethod Algorithm="<a href="http://www.w3.org/2001/04/xmlenc#rsa-1_5">http://www.w3.org/2001/04/xmlenc#rsa-1_5</a>"/></p>
<p class="p1"> <ds:KeyInfo></p>
<p class="p1"> <ds:KeyName>EMAILADDRESS=<a href="mailto:cloudops@audaxhealth.com">cloudops@audaxhealth.com</a>, CN=<a href="http://www.dev.careverge.com">www.dev.careverge.com</a>, OU=Cloud Ops, O=Audax Health Inc., L=Washington, ST=District of Columbia, C=US</ds:KeyName></p>
<p class="p1"> </ds:KeyInfo></p>
<p class="p1"> <CipherData></p>
<p class="p1"> <CipherValue>...</CipherValue></p>
<p class="p1"> </CipherData></p>
<p class="p1"> </EncryptedKey></p>
<p class="p1"> </ds:KeyInfo></p>
<p class="p1"> <CipherData></p>
<p class="p1"> <CipherValue>...</CipherValue></p>
<p class="p1"> </CipherData></p>
<p class="p1"></EncryptedData></p>
<p class="p1"></saml:EncryptedAssertion></p><p class="p1"><br></p><br><div class="gmail_quote">On Tue, Jul 24, 2012 at 8:28 AM, Rob Whitener <span dir="ltr"><<a href="mailto:rob.whitener@audaxhealth.com" target="_blank">rob.whitener@audaxhealth.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">This is helpful. I don't have a key and cert in PEM format. I just have a .key and a .crt (well, at least I don't think I have it in PEM format). I will look into this some more.<div>
<br></div><div>When I run the openssl command against the cert, I do get back that information.<div><div class="h5"><br>
<br><div class="gmail_quote">On Tue, Jul 24, 2012 at 3:45 AM, Yannick Béot <span dir="ltr"><<a href="mailto:yannick.beot@gmail.com" target="_blank">yannick.beot@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
I would not bother about the UUID. <div>Inside your shibboleth configuration, you should have something like</div><div> <CredentialResolver type="File" key="sp-key.pem" certificate="sp-cert.pem"/></div>
<div><br></div><div>Use the following openssl command to get the subject of the certificate:</div><div><div>openssl x509 -in sp-cert.pem -subject -noout</div><div><br></div><div>You should see something like </div><div>subject= /EMAILADDRESS=<a href="mailto:cloudops@audaxhealth.com" target="_blank">cloudops@audaxhealth.com</a>/ CN=<a href="http://www.dev.careverge.com/" target="_blank">www.dev.careverge.com</a>/OU=Cloud Ops/O=Audax Health Inc./ L=Washington/ST=District of Columbia/C=US</div>
</div><div><br></div><div>How did you get the metadata you sent to your IdP?</div><div><br></div><div>In any case, I would to try to exchange again the metadata. <span><font color="#888888"><br><br>Y.</font></span><div>
<div><br><br><div class="gmail_quote">On Mon, Jul 23, 2012 at 10:54 PM, Rob Whitener <span dir="ltr"><<a href="mailto:rob.whitener@audaxhealth.com" target="_blank">rob.whitener@audaxhealth.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div>Its hard to tell. I have this in the assertion for the encrypted assertion:</div><div><br></div></EncryptionMethod><ds:KeyInfo><EncryptedKey Id="uuidb5469dbb-0138-1020-ab16-fef9662dd66c"><EncryptionMethod Algorithm="<a href="http://www.w3.org/2001/04/xmlenc#rsa-1_5" target="_blank">http://www.w3.org/2001/04/xmlenc#rsa-1_5</a>"></EncryptionMethod><ds:KeyInfo><ds:KeyName>EMAILADDRESS=<a href="mailto:cloudops@audaxhealth.com" target="_blank">cloudops@audaxhealth.com</a>, CN=<a href="http://www.dev.careverge.com" target="_blank">www.dev.careverge.com</a>, OU=Cloud Ops, O=Audax Health Inc., L=Washington, ST=District of Columbia, C=US</ds:KeyName><div>
<br></div><div>Where it looks like the encrypted key is being looked up by UUID. There is a key in the asswertion, but the assertion indicates it is used for the signature. Comparing the key in the assertion to the keys in the IDP metadata, it looks like the same key that is used for both encryption and signing (odd). I have no UUID indicators in the metadata anywhere, so I am not sure if there is another way to see either what the UUID is indexing or how it is being used.</div>
<div><br></div><div>Thanks,</div><div><br></div><div>Rob</div><div><div><div><br><br><div class="gmail_quote">On Mon, Jul 23, 2012 at 4:30 PM, Cantor, Scott <span dir="ltr"><<a href="mailto:cantor.2@osu.edu" target="_blank">cantor.2@osu.edu</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div>On 7/23/12 4:14 PM, "Rob Whitener" <<a href="mailto:rob.whitener@audaxhealth.com" target="_blank">rob.whitener@audaxhealth.com</a>> wrote:<br>
><br>
>At Scott Cantor's suggestion, I asked our partner to encrypt the whole<br>
>assertion, rather than just the attributes (they took it upon themselves<br>
>to have the attributes remain encrypted as well, inside the already<br>
>encrypted assertion? Seems like too much encryption<br>
> to me).<br>
<br>
</div>It also won't fix your issue, although...<br>
<div><br>
>Now, we are seeing errors like this in Syslog:<br>
><br>
>Jul 23 19:18:21 ip-10-90-230-192 shibboleth-sp: 1343071101 ERROR<br>
>Shibboleth.Listener [24585] shib_check_user: remoted message returned an<br>
>error: A valid authentication statement was not found in the incoming<br>
>message.<br>
<br>
</div>That means you can't decrypt with the key they used, as Nate said, and<br>
that should also be happening in the original case of the<br>
EncryptedAttribute (not in syslog, it will just be a warning in shibd.log).<br>
<div><div><br>
-- Scott<br>
<br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a><br>
</div></div></blockquote></div><br></div>
</div></div><br>--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a><br></blockquote></div><br></div></div></div>
<br>--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a><br></blockquote></div><br></div></div></div>
</blockquote></div><br></div></div>