<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<p><br>
</p>
<div class="moz-cite-prefix">On 4/10/25 3:55 PM, Brent Putman wrote:<br>
</div>
<blockquote type="cite"
cite="mid:7523c9b5-7385-dd86-d964-910841a054f9@georgetown.edu">
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<p>In the IdP what you'd need then is support for building a
Credential with the key on disk, and I seem to remember
implementing something like that, i.e. reading the
base64-encoded bits of a symmetric key. Not 100% sure though.
Paul, if you really want to try and support it with that SP, I
can look to confirm that.</p>
<br>
</blockquote>
<p>Yeah, we do support. Even more surprisingly, it's actually
(almost entirely) documented in the wiki. :-)</p>
<p>For the Spring Credential factories see here:</p>
<p><a class="moz-txt-link-freetext" href="https://shibboleth.atlassian.net/wiki/x/mKG0vg">https://shibboleth.atlassian.net/wiki/x/mKG0vg</a><br>
</p>
<p>specifically the BasicCredential ones:
shibboleth.BasicResourceCredentialFactoryBean and
shibboleth.BasicInlineCredentialFactoryBean. You'd want to
configure the secretKeyAlgorithm, secretKeyEncoding and
secretKeyInfo attributes appropriately. Probably also the
entityID, if for no other reason than documentation purposes. And
perhaps also keyNames, if the SP sends a ds:KeyName element in the
message ds:KeyInfo structure as a hint to the specific key used.</p>
<p>Then you'd wire that into an RP-specific config:</p>
<p><a class="moz-txt-link-freetext" href="https://shibboleth.atlassian.net/wiki/x/PaG0vg">https://shibboleth.atlassian.net/wiki/x/PaG0vg</a><br>
</p>
<p>specifically the Per-Profile Credential section. The example
there is for a signing credential, but the encryption one would be
similar in structure, just different property names and parent
beans on the security config object itself. Something like this
(untested):</p>
<p><font face="monospace"><bean id="ObnoxiousSecurityConfig"
parent="shibboleth.DefaultSecurityConfiguration"><br>
<property name="encryptionConfiguration"><br>
<bean parent="shibboleth.EncryptionConfiguration.GCM"
p:keyTransportEncryptionCredentials-ref="ObnoxiousVendorCredential"
/><br>
</property><br>
</bean></font><br>
<br>
</p>
<p>That assumes (in the context of an already insane requirement)
that they are rational and do use symmetric key wrap. Technically
XML Encryption and OpenSAML also support forgoing the indirection
of the key wrap and using a pre-shared key for the data encryption
directly, but that's considered highly insecure and bonkers
(shouldn't encrypt multiple messages over time with the same key).
So if they want that I'd maybe "just say no" ... <br>
</p>
<p>I'll leave to your judgement whether you actually want to attempt
to acquiesce to this vendor's highly atypical requirement. :-)<br>
</p>
<p>--Brent</p>
<p><br>
<br>
<span data-code-lang="xml" data-ds--code--code-block=""
style="--ads-code-line-number-width: calc(2ch + 16px);
--ads-highlighted-start-text: Highlight start;
--ads-highlighted-end-text: Highlight end;" class="prismjs
_2rkoglpi _1dqoglyw _1wyb1crf _k48pi7a9 _1e0c1txw _vwz4gktf
_1reo1wug _o572qvpr _1eimjvyg _bfhktkvp _syaz1fxt _ect41odn
_1ozdn7od _7xinn7od _t7aun7od _1v15u2gc _ilvcu2gc _m29uu2gc
_17wyu2gc _pn28u2gc _gz9fu2gc _1hmyegat _vblregat _vbulegat
_wozj1yev _1agb1yev _lkm81yev _tv41hkgb _1hmimyb0 _1ra01n1a
_1d4j1y44 _1f8gstnw _1pzyb3bt _j1w0ww7y _13cdh2mm _15ba126e
_zvy9f705 _qcxof705 _14y71a66 _j0l11wug _1weckb7n _1na21hna
_1xx2grf3 _x7c815vq _lh0y15vq _1m3815vq _qk1e15vq _12l6ysn8
_uga3ysn8 _mx8b7mnp _1kr87mnp _xo19t94y _1bemt94y _nalpstnw
_151dstnw _1exb1q9c _1hgu1q9c _1mgnt94y _nhket94y _h909m7j4
_scgayz1z _ipl81e17 _jeky1l04 _1gec1a66 _1gx21e5h _1ls01ule
_vm2c1rh5 _12ok1rh5 _rude1ule _1q16glyw _1io6glyw _juomusic
_lcwuusic _1552u2gc _12afu2gc _28ddu2gc _1i8zu2gc _12tu1a66
_zu0j1a66 _euyxusvi _cahfusvi _zhnuidpf _1amdidpf _mbgcpf9b
_bu7zpf9b _131n1giz _gy101giz _1wfuwrk5 _16kzwrk5 _9kk3moej
_cjus1w1g _9k2r1m30 _nhmw1m30 _yl021m30 _eiht5x2v _t9zb5x2v
_mqok1w1g _3hsg1w1g _i7ngn7od _9wu1fb2s _1xcoh55r _1t361fxt
_137bh55r _1k7d1fxt _97lipnps _12nh9lu1 _1g0517qg _i2ig10m5
_326z1fxt _113p131l _1n6tpnps _tgu817qg _1k47pnps _g0lx1fxt
_ys4e131l _7gp8h55r _1yvq10m5 _1vww10m5 _1rju10m5 _1v0lh55r
_wmyy17qg _748n17qg _1mfn17qg _1d7e17qg _p2vr17qg _19o610m5
_kxov17qg _1np517qg _m2f517qg _1b9tpnps _1tq6pnps _1rd2pnps
_1pbkpnps _k3lipnps _13zt131l _2g12fb2s _k86b10m5 _b5iy131l
_gti3131l _1f0gpnps _9d3e17qg _qdiapnps _72uvpnps _13dgkb7n
_170714ej _1i3h1txw _1huoidpf _1a9lidpf _20bqidpf _1oggidpf
_bympidpf _9nnjidpf" data-testid="renderer-code-block"><code class="language-xml" style="white-space: pre;"><span data-testid="renderer-code-block-line-7" data-ds--code--row="" class=""><span class=""><span class="token tag token punctuation"></span><span class=""></span></span></span></code></span></p>
</body>
</html>