wso2-extensions / identity-outbound-auth-samlsso Goto Github PK

Description:
The following error is received when an encrypted SAML assertion is received via IdP POST from an Okta IdP to WSO2:

Caused by: org.wso2.carbon.identity.application.authenticator.samlsso.exception.SAMLSSOException: Unable to decrypt the SAML Assertion
at org.wso2.carbon.identity.application.authenticator.samlsso.manager.DefaultSAML2SSOManager.processSSOResponse(DefaultSAML2SSOManager.java:518)
at org.wso2.carbon.identity.application.authenticator.samlsso.manager.DefaultSAML2SSOManager.executeSAMLReponse(DefaultSAML2SSOManager.java:383)
at org.wso2.carbon.identity.application.authenticator.samlsso.manager.DefaultSAML2SSOManager.processSAMLResponse(DefaultSAML2SSOManager.java:374)
at org.wso2.carbon.identity.application.authenticator.samlsso.manager.DefaultSAML2SSOManager.processResponse(DefaultSAML2SSOManager.java:331)
at org.wso2.carbon.identity.application.authenticator.samlsso.SAMLSSOAuthenticator.processAuthenticationResponse(SAMLSSOAuthenticator.java:252)
... 67 more
Caused by: java.lang.IndexOutOfBoundsException: Index: 0
at java.util.Collections$EmptyList.get(Collections.java:4454)
at org.opensaml.xml.util.LazyList.get(LazyList.java:90)
at org.opensaml.xml.util.ListView.get(IndexedXMLObjectChildrenList.java:312)
at org.opensaml.xml.util.ListView.get(IndexedXMLObjectChildrenList.java:238)
at org.wso2.carbon.identity.application.authenticator.samlsso.manager.DefaultSAML2SSOManager.getDecryptedAssertion(DefaultSAML2SSOManager.java:1151)
at org.wso2.carbon.identity.application.authenticator.samlsso.manager.DefaultSAML2SSOManager.processSSOResponse(DefaultSAML2SSOManager.java:516)

Looking at the XML, Okta is sending the EncryptedKey as a child of EncryptedAssertion:
<saml2:EncryptedAssertion xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">
<xenc:EncryptedData xmlns:xenc="http://www.w3.org/2001/04/xmlenc#" ...>
<xenc:EncryptedKey xmlns:xenc="http://www.w3.org/2001/04/xmlenc#" ...
</saml2:EncryptedAssertion>

Looking at the DefaultSAMLSSOManager.java, WSO2 is expecting the EncryptedKeys as a child of KeyInfo, i.e. encryptedAssertion.getEncryptedData().getKeyInfo().getEncryptedKeys().

Shouldn't the code also check for keys using encryptedAssertion.getEncryptedKeys() to comply with xmlenc or am I missing something? I believe the xmlenc specification supports three different options for retrieving EncryptedKeys.

NOTE: I have verified that the SAML Assertion can be decrypted using WSO2's private key using other SAML libraries.

Suggested Labels:

Suggested Assignees:

Affected Product Version:
All? Demonstrable in WSO2IS 5.4.1 and 5.7.0

OS, DB, other environment details and versions:
Windows orLinux with H2 or SQL Server

Steps to reproduce:

1. Configure WSO2 as a SAML application in Okta, specifying WSO2's certificate, consumer assertion URL and Enable SAML Assertion Encryption
2. Configured Okta as an Identity Provider in WSO2 using metadata imported from Okta and enable SAML Assertion Encryption
3. Click on the Okta tile to initiate a SAML POST
4. Observe "Unable to decrypt SAML Assertion" error

Related Issues:
N/A

Description:
Setting up an external SAML identity provider would be a faster, simpler process if WSO2 were able to take in IDP metadata files, similar to those it can create (from the "Resident Identity Provider" menu -> "Inbound Authentication Configuration" -> "SAML2 Web SSO Configuration" -> "Download SAML Metadata")

Suggested Labels:
enhancement, Type/Improvement

Affected Product Version:
WSO2 IS 5.4.0

Steps to reproduce:
follow steps to link one WSO2 instance to another via SAML, do not see relevant option for upload metadata when configuring Secondary as an IdP of Primary

Description:
When configuring an external IdP, automatic generation of the SP metadata file for WSO2 would simplify the process. WSO2 already supports reading these files in the inbound authenticator

Suggested Labels:
enhancement, Type/Improvement

Affected Product Version:
WSO2 IS 5.4.0 does not have this capability

Steps to reproduce:
go through the steps to connect one WSO2 instance to another via SAML, there is no apparent option to generate SP metadata in the menus involved

Caused by: java.security.InvalidKeyException: Illegal key size
at javax.crypto.Cipher.checkCryptoPerm(Cipher.java:1039)
at javax.crypto.Cipher.init(Cipher.java:1393)
at javax.crypto.Cipher.init(Cipher.java:1327)
at org.apache.xml.security.encryption.XMLCipher.decryptToByteArray(XMLCipher.java:1754)
... 72 more
TID: [-1234] [] [2020-02-29 13:44:58,188] ERROR {org.opensaml.xml.encryption.Decrypter} - Failed to decrypt EncryptedData using either EncryptedData KeyInfoCredentialResolver or EncryptedKeyResolver + EncryptedKey KeyInfoCredentialResolver
TID: [-1234] [] [2020-02-29 13:44:58,188] ERROR {org.opensaml.saml2.encryption.Decrypter} - SAML Decrypter encountered an error decrypting element content
org.opensaml.xml.encryption.DecryptionException: Failed to decrypt EncryptedData
at org.opensaml.xml.encryption.Decrypter.decryptDataToDOM(Decrypter.java:546)
at org.opensaml.xml.encryption.Decrypter.decryptDataToList(Decrypter.java:453)
at org.opensaml.xml.encryption.Decrypter.decryptData(Decrypter.java:414)
at org.opensaml.saml2.encryption.Decrypter.decryptData(Decrypter.java:141)
at org.opensaml.saml2.encryption.Decrypter.decrypt(Decrypter.java:69)
at org.wso2.carbon.identity.application.authenticator.samlsso.manager.DefaultSAML2SSOManager.getDecryptedAssertion(DefaultSAML2SSOManager.java:1158)
at org.wso2.carbon.identity.application.authenticator.samlsso.manager.DefaultSAML2SSOManager.processSSOResponse(DefaultSAML2SSOManager.java:516)
at org.wso2.carbon.identity.application.authenticator.samlsso.manager.DefaultSAML2SSOManager.executeSAMLReponse(DefaultSAML2SSOManager.java:383)
at org.wso2.carbon.identity.application.authenticator.samlsso.manager.DefaultSAML2SSOManager.processSAMLResponse(DefaultSAML2SSOManager.java:374)
at org.wso2.carbon.identity.application.authenticator.samlsso.manager.DefaultSAML2SSOManager.processResponse(DefaultSAML2SSOManager.java:331)
at org.wso2.carbon.identity.application.authenticator.samlsso.SAMLSSOAuthenticator.processAuthenticationResponse(SAMLSSOAuthenticator.java:252)
at org.wso2.carbon.identity.application.authentication.framework.AbstractApplicationAuthenticator.process(AbstractApplicationAuthenticator.java:77)
at org.wso2.carbon.identity.application.authentication.framework.handler.step.impl.DefaultStepHandler.doAuthentication(DefaultStepHandler.java:497)
at org.wso2.carbon.identity.application.authentication.framework.handler.step.impl.DefaultStepHandler.handleResponse(DefaultStepHandler.java:471)
at org.wso2.carbon.identity.application.authentication.framework.handler.step.impl.DefaultStepHandler.handle(DefaultStepHandler.java:174)