使用Java代码进行Saml断言解密

Question

Error:

Exception in thread "main" org.opensaml.xml.io.UnmarshallingException: the assertion does not appear to be encrypted
    at AssertionDecrypter.unmarshallEncryptedAssertion(AssertionDecrypter.java:162)
    at AssertionDecrypter.decryptAssertion(AssertionDecrypter.java:119)
    at AssertionDecrypter.<init>(AssertionDecrypter.java:67)
    at Saml2AssertionEncoding.main(Saml2AssertionEncoding.java:112)
Caused by: java.lang.ClassCastException: org.opensaml.saml1.core.impl.ResponseImpl cannot be cast to org.opensaml.saml2.core.EncryptedAssertion
    at AssertionDecrypter.unmarshallEncryptedAssertion(AssertionDecrypter.java:157)
    ... 3 more

My Java code

My Pom

    <dependency>
        <groupId>org.opensaml</groupId>
        <artifactId>opensaml-core</artifactId>
        <version>3.1.1</version>
        <scope>test</scope>
    </dependency>

    <dependency>
        <groupId>org.apache.santuario</groupId>
        <artifactId>xmlsec</artifactId>
        <version>2.0.8</version>
    </dependency>

    <dependency>
        <groupId>org.opensaml</groupId>
        <artifactId>opensaml</artifactId>
        <version>2.6.4</version>
    </dependency>
    <dependency>
        <groupId>org.opensaml</groupId>
        <artifactId>opensaml-saml-impl</artifactId>
        <version>3.3.0</version>
        <scope>test</scope>
    </dependency>

     <dependency>
        <!-- <groupId>org.opensaml</groupId> <artifactId>xmltooling</artifactId> 
            <version>1.3.1</version>
        <groupId>org.opensaml</groupId>
        <artifactId>xmltooling</artifactId>
        <version>1.4.4</version> -->
            <groupId>org.opensaml</groupId>
            <artifactId>xmltooling</artifactId>
            <version>1.3.1</version>
    </dependency> 
    <dependency>
        <groupId>com.jcabi</groupId>
        <artifactId>jcabi-aspects</artifactId>
        <version>0.22</version>
    </dependency>
    <dependency>
        <groupId>org.aspectj</groupId>
        <artifactId>aspectjrt</artifactId>
        <version>1.8.3</version>
    </dependency>
    <dependency>
        <groupId>com.jcabi</groupId>
        <artifactId>jcabi-xml</artifactId>
        <version>0.16.2</version>
    </dependency>
    <dependency>
        <groupId>org.slf4j</groupId>
        <artifactId>slf4j-nop</artifactId>
        <version>1.7.5</version>
        <scope>compile</scope>
    </dependency>
    <dependency>
        <groupId>org.opensaml</groupId>
        <artifactId>openws</artifactId>
        <version>1.4.1</version>
    </dependency>
    <dependency>
        <groupId>org.opensaml</groupId>
        <artifactId>opensaml</artifactId>
        <version>2.2.1</version>
    </dependency>
    <dependency>
        <groupId>org.springframework</groupId>
        <artifactId>spring-core</artifactId>
        <version>4.1.0.RELEASE</version>
    </dependency>
</dependencies>

Answer 1

It seems you need to debug encrypted XML elements. Can you check the contents of document.getDocumentElements() is right XML ?

I guess it's null or empty. After successfully got raw XML elements from above function, you can decrypt XML to plain text. For example, this site SAML Assertion Decryption - SAML Decrypt XML Tool - Decrypt SAML Response

Answer 2

Ok, seems to be two things wrong.

It looks like you are accidentally trying to decrypt the response object and not the containing assertion. You should do

Response response = unmarshaller.unmarshall(...);
return (EncryptedAssertion) response.getEncryptedAssertions().get(0)

Provided that you know that only one assertion is sent in the response.

However it seem like you are getting a SAML 1 response message and not SAML 2. Im not an expert on SAML 1 but it seem that encryptet assertions are not supported.

So first sort the protocoll version out with the one sending the message and then make sure to return the encrypted assertion and not the response object.