<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">
<div style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">
Hello,
<div class=""><br class="">
</div>
<div class="">I am attempting to set up SAML auth for on-premise GitHub Enterprise. GHE does not support encryption of anything in the SAML response. In relying-party.xml, I have set all the encryptions options to false:</div>
<div class=""><br class="">
</div>
<span class=""><font face="Courier" class=""><bean parent="RelyingPartyByName" c:relyingPartyIds="<a href="https://github-stage.its.sfu.ca/" class="">https://github-stage.its.sfu.ca</a>"><br class="">
<property name="profileConfigurations"><br class="">
<list><br class="">
<bean parent="SAML2.SSO"<br class="">
p:encryptAssertions="false"<br class="">
p:encryptNameIds="false"<br class="">
p:encryptAttributes="false"<br class="">
p:includeConditionsNotBefore="false" /><br class="">
<ref bean="SAML2.Logout" /><br class="">
</list><br class="">
</property><br class="">
</bean><br class="">
</font></span><span class=""><br class="">
</span>
<div class="">Despite this, the IdP seems to still be insisting on attempting to encrypt assertions in the response, and failing:</div>
<div class=""><br class="">
</div>
<div class="">
<div class="">2020-08-05 15:15:52,528 - x.x.x.x - DEBUG [net.shibboleth.idp.saml.saml2.profile.impl.PopulateEncryptionParameters:296] - Profile Action PopulateEncryptionParameters: Encryption for assertions (true), identifiers (false), attributes(false)</div>
<div class="">2020-08-05 15:15:52,529 - x.x.x.x - DEBUG [net.shibboleth.idp.saml.saml2.profile.impl.PopulateEncryptionParameters:306] - Profile Action PopulateEncryptionParameters: Resolving EncryptionParameters for request</div>
<div class="">2020-08-05 15:15:52,542 - x.x.x.x - DEBUG [net.shibboleth.idp.saml.saml2.profile.impl.PopulateEncryptionParameters:371] - Profile Action PopulateEncryptionParameters: Adding entityID to resolution criteria</div>
<div class="">2020-08-05 15:15:52,542 - x.x.x.x - DEBUG [net.shibboleth.idp.saml.saml2.profile.impl.PopulateEncryptionParameters:382] - Profile Action PopulateEncryptionParameters: Adding role metadata to resolution criteria</div>
<div class="">2020-08-05 15:15:52,543 - x.x.x.x - DEBUG [org.opensaml.saml.security.impl.MetadataCredentialResolver:260] - Resolving credentials from supplied RoleDescriptor using usage: ENCRYPTION. Effective entityID was:
<a href="https://github-stage.its.sfu.ca/" class="">https://github-stage.its.sfu.ca</a></div>
<div class="">2020-08-05 15:15:52,543 - x.x.x.x - DEBUG [org.opensaml.saml.security.impl.SAMLMetadataEncryptionParametersResolver:186] - Could not resolve encryption parameters based on SAML metadata, falling back to locally configured credentials and algorithms</div>
<div class="">2020-08-05 15:15:52,544 - x.x.x.x - WARN [org.opensaml.xmlsec.impl.BasicEncryptionParametersResolver:257] - Validation failure: Failed to resolve both a data and a key encryption credential</div>
<div class="">2020-08-05 15:15:52,544 - x.x.x.x - DEBUG [net.shibboleth.idp.saml.saml2.profile.impl.PopulateEncryptionParameters:322] - Profile Action PopulateEncryptionParameters: Failed to resolve EncryptionParameters</div>
<div class="">2020-08-05 15:15:52,544 - x.x.x.x - WARN [net.shibboleth.idp.saml.saml2.profile.impl.PopulateEncryptionParameters:339] - Profile Action PopulateEncryptionParameters: Resolver returned no EncryptionParameters</div>
<div class="">2020-08-05 15:15:52,580 - x.x.x.x - WARN [org.opensaml.profile.action.impl.LogEvent:105] - A non-proceed event occurred while processing the request: InvalidSecurityConfiguration</div>
<div class="">2020-08-05 15:15:52,581 - x.x.x.x - DEBUG [org.opensaml.saml.common.profile.logic.DefaultLocalErrorPredicate:173] - Error event InvalidSecurityConfiguration will be handled with response</div>
</div>
<div class=""><br class="">
</div>
<div class="">This results in an error being returned in the SAML response.</div>
<div class=""><br class="">
</div>
<div class="">The only way I've been able to get this to work is by setting `idp.encryption.optional = true` in idp.properties; it was commented-out and thus set to the default (false). </div>
<div class=""><br class="">
</div>
<div class="">
<div class="">2020-08-05 16:18:24,414 - x.x.x.x - DEBUG [net.shibboleth.idp.saml.saml2.profile.impl.PopulateEncryptionParameters:296] - Profile Action PopulateEncryptionParameters: Encryption for assertions (true), identifiers (false), attributes(false)</div>
<div class="">2020-08-05 16:18:24,415 - x.x.x.x - DEBUG [net.shibboleth.idp.saml.saml2.profile.impl.PopulateEncryptionParameters:306] - Profile Action PopulateEncryptionParameters: Resolving EncryptionParameters for request</div>
<div class="">2020-08-05 16:18:24,415 - x.x.x.x - DEBUG [net.shibboleth.idp.saml.saml2.profile.impl.PopulateEncryptionParameters:371] - Profile Action PopulateEncryptionParameters: Adding entityID to resolution criteria</div>
<div class="">2020-08-05 16:18:24,415 - x.x.x.x - DEBUG [net.shibboleth.idp.saml.saml2.profile.impl.PopulateEncryptionParameters:382] - Profile Action PopulateEncryptionParameters: Adding role metadata to resolution criteria</div>
<div class="">2020-08-05 16:18:24,415 - x.x.x.x - DEBUG [org.opensaml.saml.security.impl.MetadataCredentialResolver:260] - Resolving credentials from supplied RoleDescriptor using usage: ENCRYPTION. Effective entityID was:
<a href="https://github-stage.its.sfu.ca/" class="">https://github-stage.its.sfu.ca</a></div>
<div class="">2020-08-05 16:18:24,416 - x.x.x.x - DEBUG [org.opensaml.saml.security.impl.SAMLMetadataEncryptionParametersResolver:186] - Could not resolve encryption parameters based on SAML metadata, falling back to locally configured credentials and algorithms</div>
<div class="">2020-08-05 16:18:24,416 - x.x.x.x - DEBUG [net.shibboleth.idp.saml.saml2.profile.impl.PopulateEncryptionParameters:322] - Profile Action PopulateEncryptionParameters: Failed to resolve EncryptionParameters</div>
<div class="">2020-08-05 16:18:24,416 - x.x.x.x - DEBUG [net.shibboleth.idp.saml.saml2.profile.impl.PopulateEncryptionParameters:336] - Profile Action PopulateEncryptionParameters: Resolver returned no EncryptionParameters</div>
<div class="">2020-08-05 16:18:24,420 - x.x.x.x - DEBUG [net.shibboleth.idp.saml.saml2.profile.impl.PopulateEncryptionParameters:337] - Profile Action PopulateEncryptionParameters: Encryption is optional, ignoring inability to encrypt</div>
</div>
<div class=""><br class="">
</div>
<div class="">GitHub Enterprise's SAML metadata (<a href="https://github-stage.its.sfu.ca/saml/metadata" class="">https://github-stage.its.sfu.ca/saml/metadata</a>) doesn't specify any encryption requirements, so we're not sure why it is trying to encrypt in
the first place. We have several other SPs set up on our IDP that don't require encryption, and have the encryption options set to false in relying-party.xml, and work properly.</div>
<div class=""><br class="">
</div>
<div class="">Any suggestions?</div>
<div class=""><br class="">
</div>
<div class="">
<div class="">Cheers,</div>
<div class="">Graham.</div>
</div>
<div class=""><br class="">
<div class="">
<div dir="auto" style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">
<div style="color: rgb(0, 0, 0); letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">
<div style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">
<div style="text-align: start; text-indent: 0px;" class="">– <br class="">
Graham Ballantyne <br class="">
Senior Systems Engineer | IT Services <br class="">
Simon Fraser University | Strand Hall 1001 <br class="">
8888 University Dr., Burnaby, B.C. V5A 1S6 <br class="">
604-837-6698 <br class="">
<br class="">
</div>
</div>
</div>
</div>
</div>
<br class="">
</div>
</div>
</body>
</html>