M Kidd created WSS-497:
--------------------------
Summary: Support for SAML 2.0 EncryptedAssertion Element
Key: WSS-497
URL: https://issues.apache.org/jira/browse/WSS-497
Project: WSS4J
Issue Type: New Feature
Components: WSS4J Core
Affects Versions: 1.6.15
Environment: JBoss AS 7.1.3, JBoss EAP 6.1.0
Reporter: M Kidd
Assignee: Colm O hEigeartaigh
Fix For: 1.6.16
WSS4J cannot locate an Assertion via a SecurityTokenReference KeyIdentifier id
when the Assertion is encrypted as an EncryptedAssertion element.
{quote}
<soap:Envelope xmlns:soap="http://www.w3.org/2003/05/soap-envelope";>
<soap:Header>
<Action xmlns="http://www.w3.org/2005/08/addressing";>ActionXXXX</Action>
<MessageID
xmlns="http://www.w3.org/2005/08/addressing";>urn:uuid:f718f460-58a5-4aa5-a0ae-7e2a6d9dea8a</MessageID>
<To
xmlns="http://www.w3.org/2005/08/addressing";>https://xxxx:1234/catalog/xxxService-v1.0</To>
<ReplyTo xmlns="http://www.w3.org/2005/08/addressing";>
<Address>http://www.w3.org/2005/08/addressing/anonymous</Address>
</ReplyTo>
<wsse:Security soap:mustUnderstand="true"
xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd";
xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd";>
<wsu:Timestamp wsu:Id="TS-127">
<wsu:Created>2014-04-22T13:00:42.301Z</wsu:Created>
<wsu:Expires>2014-04-22T13:05:42.301Z</wsu:Expires>
</wsu:Timestamp>
<EncryptedAssertion xmlns="urn:oasis:names:tc:SAML:2.0:assertion">
<xenc:EncryptedData Type="http://www.w3.org/2001/04/xmlenc#Element";
xmlns:xenc="http://www.w3.org/2001/04/xmlenc#";>
<xenc:EncryptionMethod
Algorithm="http://www.w3.org/2001/04/xmlenc#aes256-cbc"/>
<KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#";>
<e:EncryptedKey xmlns:e="http://www.w3.org/2001/04/xmlenc#";>
<e:EncryptionMethod
Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p";>
<DigestMethod
Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
</e:EncryptionMethod>
<KeyInfo>
<o:SecurityTokenReference
xmlns:o="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd";>
<X509Data>
<X509IssuerSerial>
<X509IssuerName>.....</X509IssuerName>
<X509SerialNumber>12345678</X509SerialNumber>
</X509IssuerSerial>
</X509Data>
</o:SecurityTokenReference>
</KeyInfo>
<e:CipherData>***MASKED***</e:CipherData>
</e:EncryptedKey>
</KeyInfo>
<xenc:CipherData>***MASKED***</xenc:CipherData>
</xenc:EncryptedData>
</EncryptedAssertion>
<ds:Signature Id="SIG-128" xmlns:ds="http://www.w3.org/2000/09/xmldsig#";>
<ds:SignedInfo>
<ds:CanonicalizationMethod
Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#";>
<ec:InclusiveNamespaces PrefixList="soap"
xmlns:ec="http://www.w3.org/2001/10/xml-exc-c14n#"/>
</ds:CanonicalizationMethod>
<ds:SignatureMethod
Algorithm="http://www.w3.org/2000/09/xmldsig#hmac-sha1"/>
<ds:Reference URI="#TS-127">
<ds:Transforms>
<ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#";>
<ec:InclusiveNamespaces PrefixList="wsse soap"
xmlns:ec="http://www.w3.org/2001/10/xml-exc-c14n#"/>
</ds:Transform>
</ds:Transforms>
<ds:DigestMethod
Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
<ds:DigestValue>/wED0P+e1Hl79GX3yuHw/p/J2Vo=</ds:DigestValue>
</ds:Reference>
</ds:SignedInfo>
<ds:SignatureValue>Wgp/uzeawdu8oh8bDObXIsXrTUw=</ds:SignatureValue>
<ds:KeyInfo Id="KI-1603634465EB6A36DC1398171642303115">
<SecurityTokenReference
b:TokenType="http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0";
xmlns="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd";
xmlns:b="http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd";>
<KeyIdentifier
ValueType="http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID";>_004e1ddf-d719-436b-bfb9-e833f482e4eb</KeyIdentifier>
</SecurityTokenReference>
</ds:KeyInfo>
</ds:Signature>
</wsse:Security>
</soap:Header>
<soap:Body>
</soap:Body>
</soap:Envelope>
{quote}
When the SecurityTokenReference is being parsed, it takes the KeyIdentifier
value and looks for the associated Assertion id. If it cannot locate the
Assertion, it currently falls back on invoking the CallbackHandler, seeking the
SECRET_KEY.
At some point prior to that parsing, I believe it should decrypt
EncryptedAssertion elements, using the loaded certificates from the configured
keystore, so the existing Assertion search logic can locate these Assertions.
--
This message was sent by Atlassian JIRA
(v6.2#6252)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
