Re: [higgins-dev] encrypted assertions with higgins saml2 util library

[Torgeir Veimo <torgeir@xxxxxxxxxxxxxx>]

2009/6/12 Markus Sabadello <markus.sabadello@xxxxxxxxx>:
> If you create such an EncryptedAssertion class or other extensions to that
> library, would you be interested in contributing them to Higgins? I think
> that if those extensions are generic enough (not limited to your particular
> use case), they could fit well into what we already have.

I doubt that it will be good enough to include. The approach I'm
trying out is simply;

In SAMLResponse, in the getSAMLAssertion() method, if the assertion
element is null, try to fetch an encrypted assertion element instead,
then call a decrypt method, passing in a key provided earlier.

In the decrypt method, since this is basically just xml encryption
standard stuff, all I have to do is

private void decryptElement(Document document, PrivateKey privateKey) {

        String namespaceURI = EncryptionConstants.EncryptionSpecNS;
        String localName = EncryptionConstants._TAG_ENCRYPTEDDATA;
        Element encryptedDataElement =
(Element)document.getElementsByTagNameNS(namespaceURI,
localName).item(0);

        try {
            XMLCipher xmlCipher = XMLCipher.getInstance();

            xmlCipher.init(XMLCipher.DECRYPT_MODE, null);
            xmlCipher.setKEK(privateKey);
            xmlCipher.doFinal(document, encryptedDataElement);
        } catch (Exception ee) {
            log.error("unable to decrypt node; ", ee);
        }
    }

(Using apache xml security.)

This code will then put the decrypted assertion xml fragment back into
the document, from where the assertion element can simply be retrieved
as normal, returning a normal SAMLAssertion created from it.

I'm currently testing this, but am having some key issues i think.
There are no private key PEM-file loaders around for java it seems..

-- 
-Tor