在 OpemSAML 3.x 中解密 Saml2 断言

Question

我使用 simplesamlphp 作为 IdP 和使用 spring 编码的服务提供商。我将 IdP 配置为生成如下加密断言：

<saml:EncryptedAssertion>
    <xenc:EncryptedData xmlns:xenc="http://www.w3.org/2001/04/xmlenc#"
                        xmlns:dsig="http://www.w3.org/2000/09/xmldsig#"
                        Type="http://www.w3.org/2001/04/xmlenc#Element">
        <xenc:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#aes128-cbc"/>
        <dsig:KeyInfo xmlns:dsig="http://www.w3.org/2000/09/xmldsig#">
            <xenc:EncryptedKey>
                <xenc:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p"/>
                <xenc:CipherData>
                    <xenc:CipherValue>
                        I1G9MuiHnxoYSn4yROje9m6E5adZ/aPYD7FfBtSlroQlKWUHw2pqI9F3Yy6jz9PwTMgNlwczEvjm/j/tvuRW2DKhD/43XcY6al7pCnDHtSACXYOjPyBoEf8iNG4cZdHGjc3Y2ZTW67HpJoyVr3CGMNrGljnCtgSexOPypACGwyV5F/vCw9soKK6M8c3n8ao2d6pwnaVLAlQRqm3++FPWA82mSsT2v5eW1pc1p1NTEjKl7tT6dVTubdJstkWmtvxYLTuerIIbBkFrxlPvi7vhKHZSG5h2rxXFHL1GIUH1BpC46IUX0y3b7H2q0UNCc89hs1Q8RuPKXsZL4H2s61LgjR/EsF5IKUjCmWc+i138/BlYulCVY9AFjHOKerXmuek2+rjTDo9on0Ge1FO0Bk6oYyJkAcEM/X0mOEi0Oe7TG6e2Xn3A46BWC3YY1CNDShRbNW8BXqgaKQbT6fe0qYb+U/Gs9o/SVjYWQ1o2AJKpj8aBdE2IKUbZAeRXkokAg8I+tU3lQwBJtaWzOQV794iAmHJkkGofdPalyNNzoxYsKE7FLj+9hVTw30VsOVvsm3BF9X3tWhU2mVAonYMFTc8ZItI/a/yc+qcE4dBERiz1mK377tXa/pnhTQdjUQCurjGbTBHSBL056+vVqFw85sSo8mZdcjo4Mna+IHi0BPbr5yU=
                    </xenc:CipherValue>
                </xenc:CipherData>
            </xenc:EncryptedKey>
        </dsig:KeyInfo>
        <xenc:CipherData>
            <xenc:CipherValue>
                eBosRfusksmNH1ZFP9SbnD8yvgQ750Brp1whSBNAihB27I8QAVAcHPDuPlK0CS67IydRHDxzQXiWVbHumHRp+mQYcV501W64T++Gq6Ht6O5IuF/o5FYUR+sg7+XsszbxOAvXc72UBVEFydC7sk9cTutOIPjbXz8VDWT2CGHoXLQvAFIXyQ4Wc6lhbk48i74EazWnwoaarR9W0Qtt0K1S52K7f5KFemt466bt1WoEc06MTd7+grQ7zXQZOKjsCaBiTI6BincmN1h+He7u5tZyu54WdkwMMfyoE1hgmTyvafhdu/0s1TPMkFin25Ww4G6hpDjmeQRtaMZxhaa88afeanniAlI6VElqVHUIn/RNpbpQzl4Z85Qb+JuP9hEU12aQJumjZ8G8W1LKzzjl7C6nU+g2WB2y6I7zIL3H7dhGtGf65VnQYcfbcrQ0htVdtWjBXEeJgAnFzssyIByhO1GLbDQPfBujM3WtMLQLiyol9QkUQLSekQJQvzHkHiSk4ZcWJZsySL4oN8yuIdpU/xvGvcnTk4NXKl8em1oyU8kGYAWcUKCMTPkkM6DbjbzcUvm7UCkOZzPzsj5SOgu2D4QCB83dcpcalRjKe96YzF4WUe92L1nmJmp8B0d5BDuZvbFdK0w6LEnDEDI9gIgPVEi0JCp884ZqEUvBTlpNZkwld6sZR3Zjl+hdjiZCYbbWqazVvNLGE1KR/DLDRtlvJOTVJhMjwu9ZuUg2F2UB9yh241icTIjG8qCc9alAD04tv7MCm9qq3nlyTzRLUL47TGGgNrxZumG9ILrjGuI1lEG+RVji1+ohnKyQK6etFUaXS540hbcJ7txC8MT/6BmuA3RbPZsAKhYxIK5qwaoLGMVEXlbIC9OhpVIEfH2Cu4nFRk1T7nbrMSeH3FfISK0pSnqJ5886riXAc5AbE08t4fjeDnBpJ1Fz1uUGVTJsuEC1MeOwFY5JvyhDoaUb+IsMYetC6JfP2FwXouwoVZKK2VHRZS/MIdqsbkB1+Nl023aS0JrA+lVBLs5szxqCfAsphJkJobSY4V20i0qh1iXRnTDnBelyJU+FTO5mPyiHFtv1kLu9fmdnALKZ54gbH5Kg/1LT4lbXmbBXRMmECGtbc1njGvUdt0sc4xGzLwr3Sm0Z+t1JzPTEsac6AS/BAIuCDomhK2QbPmYp5CTB055olvMptrts2fOae68PY194XRCRY5nMQsZe41OMbR4dztl/kr960vGNZvX6Y1tQKMgR2cw1gjm0A3ejDgllPkVnNCvEooVmWOhb+vMXzAEcjUwXqQP4bjIeOvhAoOLxxSVoCCHYW67u0grMN6nsvytUreoSQ+BthIADrUb0uJ1Thqiu4mN6+DT9TUtaAchnh1knk26chE6ixJLW9Glu6QmY+rcRZyQ0DzUD00QTDqxa03duq1eg9tnkIMLmakV2IzvEk0/rEik9DokDa21lAi+UevkoorffEBIV5ks4gVMDkVISxJhyfh1cJRHX57ntjaG97YPwkQRzaeOfywEPA0+WJgdUBj9aurTWfxlQDZIgpCuDLns0qL4zBInp90OTF/Lu6B3Kl3xMgHyiJzcJjZAQ7HFyUa+pE5IhcTe/1Pn8rL84D9f2KW3acTixhmqiFrObYM5USr9W3RdJbIawPpNt2RiNj9KrHpD+6rgLkiWS6Lx2CB150mb12UTUoR6K9EX7yQ3BqVX9Dhz2DqYC+OUTHbjRc3xcLb0tsEFyhD5qwHafLtCyrG6/iia9nQ9sP2/DC0hF4KV9frCJ7xoTjzkCy1kYGm207IAoZjg3iiQ+1uJKrGO5yzaME+kDiiJY/HzfwoIpFCYDP7cAGxe2W1xWBqBhn5qR41EsjoHnDD3cVhH5LVAdCOyV5FzXAPEPJeGUC/abJcx2HNMQdOF1u60fhJBZLuMyXzfVkBv7qoyI7oGlzHfqYr3BIZWsIVVrRJjx4R3cMkHjBNyBkQVjgfAM5z5KgdxRbkbwe5EYkckDLTS4ZWUJZAa0VIU/kz8AuMqy9/oqOPzhGrHDocFKMNt2BiIpeXoIl+8v/Xe2EJTSOThY+EOPag/ukdBw8VCh83HO3u902sk4vL2GPhx7ogbCikAvyRr50b0RdNOed64cWXif7TK1tzHYTPhULz5nWocVfQDjMKwvksH0PnVvAUlTpERvUI6/U2M4UC6r5c8VJjIRjQwJZvXz4dd2TgiwqC0HwCzHwZrAg9B8ZitWM3YLTclbAAP7rgemDWer7rL56SN7vH+fRhGfqppCKIyKNo3FVy1oTArgH73DymIwnZ+ItvZC8Nqfdd6mkhStJUp2+Mod+jr1ByGvOKTvTuDvJvvWy1A46MPuhPGgStKBwgada7djrCfx2UjweNMnrEgPJF9v7/JO6o9ZldmCR+1do/FtooNXVQknRCIue6KaPXnoxO4bDhs2Wjeej16mvo3qvtFPX7BU2nLAx3HbqZ8PWGlc6r2tmBrixCeQFJok2g0eze95GleoNDXzC52L1Q3XOzQvtDVEY4FkTXwnBD1dNEeWM8PJFAB6eMlJMT3AgpO3K9Xw9fJNx9eK6u9WPYf9xng73kvfM8i7B7z0tI/u1p5cyCGxW0BeAVrClaYksG3gZYw2uZFCYuH2C+3rXbxaKK7wusOj8l93Z7eABu+n1fethms0M5V2xJeYr1DLcoJN24iXLW+Bn0XYINAT3+xVLmxXK2kAqpA3o562G1ziOniKn3Jh6o+fN/3MLfBTAd3iYh2i8QXhXi9PHJGeX6WDqsCs4ON6TDhUi7ZFnPYpU5WqfirM++2Axw82xzgtnzz8AFdRbF+XI3iVfKRs5nd3QQPnDPHiFv7tpyq0y+39IBbA/i0aI0sPKcl/TF91zhGwQ7gu6l3UDeRs83+KvU1ADhpRs4wRD513v+xEVXRwtI6okiBCRNKA8YmGM66zXQOpCGhcDxLwqtz77DGT+hygpivo8GKxNI/ni9hT+3k89kCX4BioHgdzh7h9SahRwRPLUW4EcWxOjIAqHJrJNBlVS3PczPsSH+RbRWOvHawPtGBVb3Ylh1aFF0nBB4MPA2QjNItjzDLwB/MkBa6WQJOQ+Jt5O7znrMvf0+wfBgsANRljNUBC1pyj9v4bhZMp0sLcHhqQLOJCsYuwP3ABnGz1r2xprnUb/xaaQjl+GtzBT/OZHOVTGRzebto7NQqRuU8SUIQ3Z4MCCRdJnXLsLCrk3oS5+r2NyHTwFJbPhx7jUAeQd+36br/5m80K7wkmdwfeGxJamd7n3HafbgLu5Awf2lxxjf79ZiHLmVH6b4ky+7dTQ9bZLPM0jmnLEZZdghaSmf9/J7TzyoDCcMK9Lz5VPc3Qj9jaOKjYjj1DVAufvtBxFdVZKNHX+s619ZeBzVLqHDte5QlsfpAYw6kbSSlCeotMJr6K9qanEYLOm6JlM3rrnflHacCpO2ilQsucYIPNeqRyAbVqoVJ+qT8ZYCU7G3uPbSHkCFGHrMMkLk2LQNpUyBJrk1hyKgezc91ahWnB+n5EMcDiZz+eA94DKY8pVwjJc0SFp7v2j+wV9m8I18aK0rIyUKDdsqSEm16GprPL96nujVUeJ9rXDuFWOwl3voN5/OsovQPk64DQKPBMr7sY32EVEsuAJaq9qfblK7KG9qzyWOyEXZJqinc5nkPRSJBhx6J6NnXSTUYjPCP7F0P5//VlB0hXH6FR/++LhL6wSqoYTbIaUfajZkTlACynTVNsP8Q7TyfxYmMKHpxor+VlpXe6SDoWAdAY/DfHQ05BeP2vodPMDlkLzq0Pa2JuTFlyUUeCerFPZJY4CtoLFozK2w2SBXVGymASZ6oRjyEOVHwcviHfTHUmfQQnRRXfHEDVs8ejz2Q3rLqx6q9SQ82Bi5ohZZ2wwsW0YZX/lMA82zWbA33D2jAndsX0/RCwq24yDEu5JpeN0dSdQsbav1baZJCgSnr5U8Sd9voacA3hvcV77QvYDN5AIfRMzR9Ct1ONy3pZyXSVIjAPkPMtA0SDNvWK27suLGP4HdxatJLEYvZdNcpAdlfNIlYYen8AUFIAcvoGJTJZqSFQTY6F9OEXIi80mLx8hRrdah3cnK65oi7JMwYbMqbA9Gwnr2WJDv05868MUjshg5oDuyAwY0hRT2J8bAgifdvbS82DD013opaTrR212WpvNw0jthFvavvWKg9LtYh3KwEn2917nXXUHQ/4XLrb04LaUbH9yG0Wss8kDoNOEGOJ8mH/Uhd9k/H12zHv/fSMnSXQdx33BflPHlhsFH042PDwX6GqcWQYBXGea6Ac7ILLuwMY8pwtGHVcc9zuVDNERGGcOieL67YRwMs6/FvN25QZA6Gp7Nv4ZlZMjEtuSaUgy3jZyv5Z1AnzRQkHyc7yWMtsLC5qRm2Bg5qscI/zAdln0q2+F7+p62ooK3dMEddwRpP/U70noGTUEWnWHpUx0WUCABDfi58pjSrdTWn9zU3qvfsQyM+xde0Wu7996WupMjkW878r9c2s+/3qfJK7HTSqGgbHagVolBntWk/bIw0t2OoAy0rNGpvaMbG7MArTrrOHC9XOTzJVxQS16zp/x02xhIHTHUsSKhXFVOUSgaRfX8gRCNcoGnWaYitCeqBfG7W99voCGu2bgq02CjGMtqjL/NIUFYy5bGShrP10b06xyfEnTdsaxbEA/iA8ixkZmxTumFjSDFejWX83PLljvzlzMGqgP1bl85XcpC+kgWQQ4L8v+B2pAKBRviyF8wpMnVuM8K8wWE2tgPnW8Rzm8mpWZU9xytGYDIJDDkH2ztLjs/LvVc2AsRNPAjbqJGzwEHoThKUbE07WmfSc+WDIGSxQKTcS3NRTjIaqogFAYW8of41r7trktpKox7rlpCgrvFRd7jK9tf5OQl8SmTtokm40LnGrBu8XqU767ANpXoSh8GYXFTyJp9TLSOh3DybUPs3EEYPdto8mh4jk3clp+C/+zBAlicjUoi758NSA/P1zWuQ++oTaw3lOcu7Kv6CuWy64DA1N0W4uyV7mB3mDEwLCeE3W+F9l0dp4fPlAfuu0usQI/aFd5Ah8ToxZh4f+69OD7g1oA0EYUbbnzCBUTPVeJFOmnsVvKUK6N2rUoSwfaXPHYiW+s2REiRsE7lhTKHOrA8ne468sTnO/fJxXYRDPGeUR+U24IqEFpFIWLr0fiR0eOXt9dvSViAP6mZhItubECXgRIn6+/wnJQ3Uv+/06EaqUhEhIbhWc2nBw2lmVH87THSTu6XosS99VU60e/LV9YaBA44tceJkOUEoCFyCD5XIYx1iWdCfScPrSOO/4AQ3jX44qiP4MQsA9JFBRh8x+4pYOf0pgv6j+JBb1Ye2n+zbrMjACkn76mw/2GNnWlRi0Fjuoq6toZrX8cxju+TGCJpPAYHamAyobnL3PuBmGeNvbwPcXTDlI/jq/XKZ1TM3rE3ztvDIfLwsMZwXfJabrbVoINe/BaIo9bZSn1z2/80KiM9Q5PvMoKODrIVTPTDayQATKLrt2J5v4v5ZQJD+QdHNsVkLhBm66umx7zg6MVLkC7UrSer7WZEyBg7yMN9ANcmqCSXm8wXxsPOk7aAXuAsGEegKY1y8MA9gTGkf/sCObUmZQX6sNDT/rS5KgNgnsFgwMCLxRBH1cB+RJyuC0xP8BcKuwOcT27YudHIJztd+mgN1bQ/GIkYysNapCKbOiG4E+BL856F74n++cvAA4K5b5/6PCHD46t/RnjO3RF8/NiAae4KA8MdnrlpgUvdgyhHNwvFQ7+crgvyLGh7Aq+o+ytq/LMgKzwXVn0Rg4Kw8dkt4JsvwfQzziUBL9hDhW1UZ+ttMbZKySWWFyMHZLfQCj9LchC7ay2ea691wWRqCdrPAvWFGtV74uoRtPGXvVSz0cXKg1w1tMJrYX9Za3ZjO5Uvoaos4zN0SCKaPhzB5O8A+mn8dysLYFBdDlMwELp8b1ojbDLAth301elMY3NC2ARMal8euP1BGZ6c5xG/fcUkoZHzbQ4Q4UnSq1B1YzQhMpm7b8pES6D0cumZUEKK51dpRMkADW1qfJqJbXWyU1PUj1uPte+FnCfHqpXfMW965nb+VLJKWxxlPJ+Myl3a8VIY0AouW6A9V/iZ/ubPWqjD3mMAxAfmmqONk60LLPKxEDkU6cja2Td+QOBfDImIxyQUeSkS1utgDSK/f8Os+1Q0Y02421FXutYKfAGkcXm/kYpQESLJqY0HEw1KRqOHyMyMTXBWqB8UDrM5tbPol1QMDNy7xb6bDNe4WtG0yaB5HPi5N0c2HXEHCnq9XbhGtYEHQTPtNv2sJeUwDOITzYngRoulo33wQGjexsnWKN4XAK8b5HXL6V3eb8R2FDmscNIFgAEfz88IzPsu0210Jz1bDv3igh6Auj2drnD3Oqwp3ky6l0/6povl/3hDVV7XiIVhFdef/o04JNDibshPtRjXAwZoJ1lW1c5UU2cuTE1XBLS/kLZC+Ei42sYs7a3RyiuYqe52NbsiAnaOlouNU7rGknZZV8//jTd4O6I/MV/zPQ2zFLX/4VutLnYDKaP95WVsQV+IWHpEwAcaTkN5H9Nw2Ii+ZwIaIQRrJyO0YWk6Y7+wzkXcB9dLporICzpWTrwA4YNDoFy6WwDq4m6aJykcsSBgQxSC+epxiXZJ8gpv/h92s+m3yv5xgYRtmI12Rj8qdiQ0t6O7jU4ZDizPTBzTkycezOB9kNRADiykpOK6FvI45TnNJvD7QNm9cRAu27vqIcAIMfroOamS0hfCE9KQt1qOsU8ACX1IJzdC49dglYGG6dZQkySOYzD17C6iy7MwQwqn50KLL0/tSyWuQYbEXILmGbgyJ+MXBU0AmgzytqoKJ+LJpFyjrfgOUJ/oqBxwc0WJVHjRY764+cTE+pOVRM3Fg8bOBIStF2duvHQCDWR8+95lCcOZBdeBYwd3lHSXSFHmwpHAvRlqYjAc5DtJNiPEW6b+EKuiZf7O4LW6Dwnmp+l11z/rgKsb4sR9bqjOzFaJBzY77XU6WrwpTN5ZnUe8PlW24ViO4PLyJ5icQJI94qdi9Ico7aByDRU3xVM5nDVaeG9yB8rzGb+4x7RwQAxcYJcI5x7o56qcw4EbBfmlNoMa3+f/YjOMZrMUzDerwZ/mH1+rp7VI9zp/G4/9rbgneV7bZUoONMYc4jeG9HPuT3u0PoSNDuJKNRD8eThNtGfh9tAh5nAV9dKRkTpVldTrt1P9Xh/OWjSyOldIp+vJQ7sT4t+8rdJakNF8+SIYHkgiweOQ==
            </xenc:CipherValue>
        </xenc:CipherData>
    </xenc:EncryptedData>
</saml:EncryptedAssertion>

我无法在 java 中解码此断言，因为我不知道我需要使用的正确 KeyInfoCredentialResolver 是什么。 关键信息部分是：

<dsig:KeyInfo xmlns:dsig="http://www.w3.org/2000/09/xmldsig#">
        <xenc:EncryptedKey>
            <xenc:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p"/>
            <xenc:CipherData>
                <xenc:CipherValue>
                    I1G9MuiHnxoYSn4yROje9m6E5adZ/aPYD7FfBtSlroQlKWUHw2pqI9F3Yy6jz9PwTMgNlwczEvjm/j/tvuRW2DKhD/43XcY6al7pCnDHtSACXYOjPyBoEf8iNG4cZdHGjc3Y2ZTW67HpJoyVr3CGMNrGljnCtgSexOPypACGwyV5F/vCw9soKK6M8c3n8ao2d6pwnaVLAlQRqm3++FPWA82mSsT2v5eW1pc1p1NTEjKl7tT6dVTubdJstkWmtvxYLTuerIIbBkFrxlPvi7vhKHZSG5h2rxXFHL1GIUH1BpC46IUX0y3b7H2q0UNCc89hs1Q8RuPKXsZL4H2s61LgjR/EsF5IKUjCmWc+i138/BlYulCVY9AFjHOKerXmuek2+rjTDo9on0Ge1FO0Bk6oYyJkAcEM/X0mOEi0Oe7TG6e2Xn3A46BWC3YY1CNDShRbNW8BXqgaKQbT6fe0qYb+U/Gs9o/SVjYWQ1o2AJKpj8aBdE2IKUbZAeRXkokAg8I+tU3lQwBJtaWzOQV794iAmHJkkGofdPalyNNzoxYsKE7FLj+9hVTw30VsOVvsm3BF9X3tWhU2mVAonYMFTc8ZItI/a/yc+qcE4dBERiz1mK377tXa/pnhTQdjUQCurjGbTBHSBL056+vVqFw85sSo8mZdcjo4Mna+IHi0BPbr5yU=
                </xenc:CipherValue>
            </xenc:CipherData>
        </xenc:EncryptedKey>
    </dsig:KeyInfo>

我已经创建了这样的 KeyInfo 凭证解析器：

 KeyInfoCredentialResolver kekResolver = new LocalKeyInfoCredentialResolver(Collections.singletonList(new InlineX509DataProvider()), credentialsResolver);

但是，InlineX509DataProvider 假定 KeyInfo 有一个 X509Data 元素，它可以在其中查找数据。 所以我不知道用于创建 KeyInfoCredentialResolver 的正确提供程序是什么。 我检查了文档（OpenSAML 3.x）并看到：

• DEREncodedKeyValueProvider
• DSAKeyValueProvider
• InlineX509DataProvider
• KeyInfoReferenceProvider
• RSAKeyValueProvider

因此，我不确定上述任何类是否可以与 simplesamlphp 断言一起使用，或者我在配置中遗漏了一些东西，我可以生成 X509Data KeyInfo。

谢谢！！