堆棧內存溢出
  簡體   English   中英

如何使用 OpenSAML 2 和 Java 測試/調試解密加密斷言？

[英]How to test/debug Decrypting Encrypted Assertion using OpenSAML 2 and Java?

 原文  2019-02-10 21:02:12  4   2    java/ encryption/ saml-2.0/ public-key-encryption/ opensaml

問題描述

我正在嘗試與 OpenSAML2 (2.6.6) 一起編寫 Java 應用程序來解密加密斷言，但我得到：

[main] ERROR org.opensaml.xml.encryption.Decrypter - Failed to decrypt EncryptedKey, valid decryption key could not be resolved
[main] ERROR org.opensaml.xml.encryption.Decrypter - Failed to decrypt EncryptedData using either EncryptedData KeyInfoCredentialResolver or EncryptedKeyResolver + EncryptedKey KeyInfoCredentialResolver
[main] ERROR org.opensaml.saml2.encryption.Decrypter - SAML Decrypter encountered an error decrypting element content

這是我的 Java 代碼（很抱歉它仍然有很多調試輸出）：

/*
 * ****************************************************************************************************
 * Original source from: https://stackoverflow.com/questions/9422545/decrypting-encrypted-assertion-using-saml-2-0-in-java-using-opensaml
 * And hint about needed to add DefaultBootstrap.bootstrap() for OpenSAML 2.x: https://stackoverflow.com/questions/25066183/opensaml-error-receiving-correct-unmarshaller
 * And hing about chain resolvers: https://www.programcreek.com/java-api-examples/index.php?api=org.opensaml.saml2.encryption.Decrypter
 * ****************************************************************************************************
 * ****************************************************************************************************
 * ****************************************************************************************************
 * ****************************************************************************************************
 */
import java.io.File;
import java.io.FileInputStream;
import java.io.InputStream;
import java.security.KeyFactory;
import java.security.interfaces.RSAPrivateKey;
import java.security.spec.PKCS8EncodedKeySpec;
import java.util.ArrayList;
import java.util.List;

import org.opensaml.DefaultBootstrap;
import org.opensaml.saml2.core.Assertion;
import org.opensaml.saml2.core.EncryptedAssertion;
import org.opensaml.saml2.encryption.Decrypter;
import org.opensaml.saml2.encryption.EncryptedElementTypeEncryptedKeyResolver;
import org.opensaml.xml.Configuration;
import org.opensaml.xml.encryption.ChainingEncryptedKeyResolver;
import org.opensaml.xml.encryption.EncryptedKeyResolver;
import org.opensaml.xml.encryption.InlineEncryptedKeyResolver;
import org.opensaml.xml.encryption.SimpleRetrievalMethodEncryptedKeyResolver;
import org.opensaml.xml.io.Unmarshaller;
import org.opensaml.xml.io.UnmarshallerFactory;
import org.opensaml.xml.parse.BasicParserPool;
import org.opensaml.xml.security.keyinfo.StaticKeyInfoCredentialResolver;
import org.opensaml.xml.security.x509.BasicX509Credential;
import org.w3c.dom.Document;
import org.w3c.dom.Element;

import org.slf4j.Logger;
import org.slf4j.LoggerFactory;

public class test_opensaml {


    public static void main(String[] args) {
        String PROGVERSION = "V1.00";

        String xmlFileName = "";
        String privateKeyFileName = "";

        System.out.println("test_opensaml " + PROGVERSION);

        if(args.length < 2) {
            System.out.println("Command line is: java test_opensaml <signed_samlassertion_xml> <private_key_der>");
            System.exit(0);
        }

        xmlFileName = args[0];
        privateKeyFileName = args[1];

        Logger logger = LoggerFactory.getLogger(test_opensaml.class);
        logger.info("xmlFileName=[" + xmlFileName + "]");
        logger.info("privateKeyFileName=[" + privateKeyFileName + "]\n");

        try {
            // Initialize the library
            DefaultBootstrap.bootstrap();
        } catch (Exception e) {
            System.out.println("** ERROR ** - ERROR WHILE Executing DefaultBootstrap.bootstrap() - e=[" + e + "]");
            System.exit(-1);
        }

        InputStream inputStream = null;

        // Load the XML file and parse it.
        File xmlFile = new File(xmlFileName);
        try {
            inputStream = new FileInputStream(xmlFile);
        } catch (Exception e) {
            System.out.println("** ERROR ** - ERROR WHILE LOADING ASSERTION XML FILE - e=[" + e + "]");
            System.exit(-1);
        }


        BasicParserPool parserPoolManager = new BasicParserPool();

        Document document = null;
        Element metadataRoot = null;
        try {
            document = parserPoolManager.parse(inputStream);
            metadataRoot = document.getDocumentElement();
            System.out.println("metadataRoot.getNodeName()=[" + metadataRoot.getNodeName() + "]");
        } catch (Exception e) {
            System.out.println("** ERROR ** - ERROR WHILE CREATING DOCUMENT FROM XML FILE - e=[" + e + "]");
            System.exit(-1);
        }

        UnmarshallerFactory unmarshallerFactory = null;
        Unmarshaller unmarshaller = null;
        EncryptedAssertion encryptedAssertion = null;

        try {
            // Unmarshall
            unmarshallerFactory = Configuration.getUnmarshallerFactory();
        } catch (Exception e) {
            System.out.println("** ERROR ** - ERROR WHILE CREATING UNMARSHALLFACTORY - e=[" + e + "]");
            System.exit(-1);
        }

        if (unmarshallerFactory == null) {
            System.out.println("unmarshallerFactory is null");
        } else {
            System.out.println("unmarshallerFactory is OK/NOT-null");
        }

        try {
            // Unmarshall
            unmarshaller = unmarshallerFactory.getUnmarshaller(metadataRoot);
            if (unmarshaller == null) {
                System.out.println("unmarshaller is null");
            } else {
                System.out.println("unmarshaller is OK/NOT-null");
            }

            System.out.println("unmarshaller.getClass().getname=[" + unmarshaller.getClass().getName() + "]");
        } catch (Exception e) {
            System.out.println("** ERROR ** - ERROR WHILE CREATING UNMARSHALLER - e=[" + e + "]");
            System.exit(-1);
        }


        try {
            // Unmarshall
            encryptedAssertion = (EncryptedAssertion)unmarshaller.unmarshall(metadataRoot);
        } catch (Exception e) {
            System.out.println("** ERROR ** - ERROR CREATING ENCRYPTEDASSERTION BY UNMARSHALLING - e=[" + e + "]");
            e.printStackTrace();
            System.exit(-1);
        }
        System.out.println("SUCCESS - CREATED ENCRYPTEDASSERTION BY UNMARSHALLING!!");
        System.out.println("Will now try to load the PRIVATE KEY FILE...");

        // Load the private key file.
        File privateKeyFile = new File(privateKeyFileName);
        FileInputStream inputStreamPrivateKey = null;
        byte[] encodedPrivateKey = null;
        try {
            inputStreamPrivateKey = new FileInputStream(privateKeyFile);
            encodedPrivateKey = new byte[(int)privateKeyFile.length()];
            inputStreamPrivateKey.read(encodedPrivateKey);
            inputStreamPrivateKey.close();
        } catch (Exception e) {
            System.out.println("** ERROR ** - ERROR WHILE READING PRIVATE KEY FROM FILE - e=[" + e + "]");
            System.exit(-1);
        }
        System.out.println("SUCCESS - READ/INPUT THE PRIVATE KEY FILE!!");

        PKCS8EncodedKeySpec privateKeySpec = null;
        RSAPrivateKey privateKey = null;
        try {
            // Create the private key.
            privateKeySpec = new PKCS8EncodedKeySpec(encodedPrivateKey);
            privateKey = (RSAPrivateKey)KeyFactory.getInstance("RSA").generatePrivate(privateKeySpec);
        } catch (Exception e) {
            System.out.println("** ERROR ** - ERROR WHILE CREATING PRIVATE KEY - e=[" + e + "]");
            System.exit(-1);
        }
        System.out.println("SUCCESS - CREATING THE PRIVATE KEY INSTANCE!!");



        ChainingEncryptedKeyResolver keyResolver = new ChainingEncryptedKeyResolver();
        keyResolver.getResolverChain().add(new InlineEncryptedKeyResolver());
        keyResolver.getResolverChain().add(new EncryptedElementTypeEncryptedKeyResolver());
        keyResolver.getResolverChain().add(new SimpleRetrievalMethodEncryptedKeyResolver());
        System.out.println("Built a list of encrypted key resolvers...");

        boolean successfulDecryption = false;

        // Create the credentials.
        BasicX509Credential decryptionCredential = new BasicX509Credential();
        decryptionCredential.setPrivateKey(privateKey);

        StaticKeyInfoCredentialResolver resolver = new StaticKeyInfoCredentialResolver(decryptionCredential);

        // Create a decrypter.
        Decrypter decrypter = new Decrypter(null, resolver, keyResolver);
        decrypter.setRootInNewDocument(true);
        // Decrypt the assertion.
        Assertion decryptedAssertion = null;
        System.out.println("WILL NOW TRY TO DECRYPT THE ENCRYPTED ASSERTION...");
        try
        {
            decryptedAssertion = decrypter.decrypt(encryptedAssertion);
        } catch (Exception e) {
            System.out.println("** ERROR ** - ERROR WHILE DECRYPTING THE ASSERTION - e=[" + e + "]");
            System.exit(-1);
        }

        System.out.println("SUCCESS - DECRYPTED THE ENCRYPTED ASSERTION - will now dump out the decrypted assertion...!!");
        System.out.println("decryptedAssertion.toString=[" + decryptedAssertion.toString() + "]");
        System.out.println("Finished...");
        System.exit(0);
    } // end main()

}

當我使用測試簽名斷言 (XML) 和私鑰運行它時，我得到以下輸出。 這是在 Eclipse 下運行並使用 Java 1.8 build 201：

test_opensaml V1.00
[main] INFO test_opensaml - xmlFileName=[E:\ECLIPSE-WORKSPACES\opensaml\opensaml\data\encrypted_assertion.xml]
[main] INFO test_opensaml - privateKeyFileName=[E:\ECLIPSE-WORKSPACES\opensaml\opensaml\data\geoaxis-gxaccess.com.private-key.der]

metadataRoot.getNodeName()=[saml:EncryptedAssertion]
unmarshallerFactory is OK/NOT-null
unmarshaller is OK/NOT-null
unmarshaller.getClass().getname=[org.opensaml.saml2.core.impl.EncryptedAssertionUnmarshaller]
SUCCESS - CREATED ENCRYPTEDASSERTION BY UNMARSHALLING!!
Will now try to load the PRIVATE KEY FILE...
SUCCESS - READ/INPUT THE PRIVATE KEY FILE!!
SUCCESS - CREATING THE PRIVATE KEY INSTANCE!!
Built a list of encrypted key resolvers...
WILL NOW TRY TO DECRYPT THE ENCRYPTED ASSERTION...
[main] ERROR org.opensaml.xml.encryption.Decrypter - Error decrypting encrypted key
org.apache.xml.security.encryption.XMLEncryptionException: Unwrapping failed
Original Exception was java.security.InvalidKeyException: Unwrapping failed
    at org.apache.xml.security.encryption.XMLCipher.decryptKey(XMLCipher.java:1539)
    at org.opensaml.xml.encryption.Decrypter.decryptKey(Decrypter.java:708)
    at org.opensaml.xml.encryption.Decrypter.decryptKey(Decrypter.java:639)
    at org.opensaml.xml.encryption.Decrypter.decryptUsingResolvedEncryptedKey(Decrypter.java:794)
    at org.opensaml.xml.encryption.Decrypter.decryptDataToDOM(Decrypter.java:535)
    at org.opensaml.xml.encryption.Decrypter.decryptDataToList(Decrypter.java:453)
    at org.opensaml.xml.encryption.Decrypter.decryptData(Decrypter.java:414)
    at org.opensaml.saml2.encryption.Decrypter.decryptData(Decrypter.java:141)
    at org.opensaml.saml2.encryption.Decrypter.decrypt(Decrypter.java:69)
    at test_opensaml.main(test_opensaml.java:193)
Caused by: java.security.InvalidKeyException: Unwrapping failed
    at com.sun.crypto.provider.RSACipher.engineUnwrap(RSACipher.java:445)
    at javax.crypto.Cipher.unwrap(Cipher.java:2549)
    at org.apache.xml.security.encryption.XMLCipher.decryptKey(XMLCipher.java:1537)
    ... 9 more
Caused by: javax.crypto.BadPaddingException: Decryption error
    at sun.security.rsa.RSAPadding.unpadOAEP(Unknown Source)
    at sun.security.rsa.RSAPadding.unpad(Unknown Source)
    at com.sun.crypto.provider.RSACipher.doFinal(RSACipher.java:363)
    at com.sun.crypto.provider.RSACipher.engineUnwrap(RSACipher.java:440)
    ... 11 more
[main] ERROR org.opensaml.xml.encryption.Decrypter - Failed to decrypt EncryptedKey, valid decryption key could not be resolved
[main] ERROR org.opensaml.xml.encryption.Decrypter - Failed to decrypt EncryptedData using either EncryptedData KeyInfoCredentialResolver or EncryptedKeyResolver + EncryptedKey KeyInfoCredentialResolver
[main] ERROR org.opensaml.saml2.encryption.Decrypter - SAML Decrypter encountered an error decrypting element content
org.opensaml.xml.encryption.DecryptionException: Failed to decrypt EncryptedData
    at org.opensaml.xml.encryption.Decrypter.decryptDataToDOM(Decrypter.java:546)
    at org.opensaml.xml.encryption.Decrypter.decryptDataToList(Decrypter.java:453)
    at org.opensaml.xml.encryption.Decrypter.decryptData(Decrypter.java:414)
    at org.opensaml.saml2.encryption.Decrypter.decryptData(Decrypter.java:141)
    at org.opensaml.saml2.encryption.Decrypter.decrypt(Decrypter.java:69)
    at test_opensaml.main(test_opensaml.java:193)
** ERROR ** - ERROR WHILE DECRYPTING THE ASSERTION - e=[org.opensaml.xml.encryption.DecryptionException: Failed to decrypt EncryptedData]

由於這是（至少對我而言）新的和未經測試的代碼，我想知道如何進一步診斷這個問題？

是否有一些額外的日志記錄或可能有助於找出問題或查明問題的東西？

我知道這聽起來有點不尋常，但僅供參考，我得到了我現在用來測試的簽名斷言和私鑰，由第三方提供，所以我實際上並不能 100% 確定他們是否很好，所以我想知道是否可以在某個地方獲取/下載已知良好的加密斷言示例以及相應的私鑰，以便我可以嘗試使用已知良好的數據測試上面的代碼？

謝謝，吉姆

編輯：對不起，我忘了包含我一直用來測試的加密斷言的片段：

<?xml version="1.0"?>
<saml:EncryptedAssertion xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">
<xenc:EncryptedData Type="http://www.w3.org/2001/04/xmlenc#Element" Id="_332ec9de74ee4a8b97b84694edb58ba9" xmlns:xenc="http://www.w3.org/2001/04/xmlenc#">
<xenc:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#aes256-cbc"/>
<ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
<xenc:EncryptedKey Type="http://www.w3.org/2001/04/xmlenc#Element" Id="_d32f036453ed438b84783a21a2e2cca7">
<xenc:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p"/>
<xenc:CipherData>
<xenc:CipherValue>Rfn5PDApVSF3wTBgsiQsFn5rybj...EZoHpGvxDPv5kAhVw==</xenc:CipherValue>
</xenc:CipherData>
</xenc:EncryptedKey>
</ds:KeyInfo>
<xenc:CipherData>
<xenc:CipherValue>FTk8D8nGOTuZsunGifMEHtj...xiAvwSQ=</xenc:CipherValue>
</xenc:CipherData>
</xenc:EncryptedData>
</saml:EncryptedAssertion>

編輯 2：對於熟悉 OpenSAML 和 SAML 的人：上面的簽名斷言有什么問題嗎？ 我一直在做一些額外的測試，似乎沒有一個解析器能夠找到加密密鑰，我注意到 ds:Keyinfo 嵌入在 xenc:EncryptedData 中，與 xenc:CipherData 處於同一級別。 這是一個正常的結構，哪個鏈式解析器應該找到 ds:Keyinfo？

2 個解決方案

解決方案1
 0  2019-02-11 21:24:14

僅供參考，一旦我找到與樣本加密斷言匹配的正確私鑰，我終於可以按原樣工作。

解決方案2
 0  2021-07-05 19:02:08

通過您的更改，我收到了 KEY LENGTH 已知錯誤，在點擊以下鏈接后問題已解決

org.apache.xml.security.encryption.XMLEncryptionException：非法密鑰大小原始異常是 java.security.InvalidKeyException：非法密鑰大小

https://faq.miniorange.com/knowledgebase/i-am-getting-org-apache-xml-security-encryption-xmlencryptionexception-illegal-key-size-exception-sso/

暫無
暫無

聲明:本站的技術帖子網頁，遵循CC BY-SA 4.0協議，如果您需要轉載，請注明本站網址或者原文地址。任何問題請咨詢:yoyou2525@163.com.

相關問題 使用OpenSAML在Java中使用SAML 2.0解密加密的斷言 opensaml java加密的斷言-無法使用EncryptedKeyResolver解密EncryptedData 如何使用 Java“漂亮打印”或“轉儲”opensaml 斷言對象？ 如何在 Java 中使用 OpenSAML 庫創建有效的 SAML 2.0 斷言 使用 OpenSAML 3 的 SAML 斷言驗證 在Java中使用加密文件而不解密到磁盤 用Java解密Rijndael，使用.NET加密 從Java中的給定XML創建OpenSAML斷言 解密由.NET的RijndaelManaged使用Java加密的字節 解密加密文件並用Java執行
相關標簽
 
粵ICP備18138465號  © 2020-2024 STACKOOM.COM