KeyInfo node in EncryptedData node

[digidentity]

KeyInfo node in EncryptedData node

[benoist]

That is possible to do.
Create an encrypted data object before encrypting the data like so:

encrypted_data = Xmlenc::Builder::EncryptedData.new
encrypted_data.set_key_retrieval_method Xmlenc::Builder::RetrievalMethod.new(
   uri: "#<key_id>"
)
encrypted_data.set_encryption_method(
   algorithm: 'http://www.w3.org/2001/04/xmlenc#aes256-cbc'
)

There is a Util function that can encrypt assertions for you, however it currently does not have the option to add key info.

libsaml/lib/saml/util.rb

Line 63 in 7110809

def encrypt_assertion(assertion, key_descriptor_or_certificate)

There is also a Util function to encrypt name ids with key info options. This eventually creates an EncryptedData object that contains the key info.
https://github.com/digidentity/libsaml/blob/master/lib/saml/elements/encrypted_id.rb#L40

I suppose the encrypted assertion can be extended to allow these options as well.
In the mean time I'd suggest to use the code from the encrypt_assertion function and add the key_retrieval_method yourself.

[luis-cbqa]

I see, actually I am using the encrypt_assertion method for encrypting the assertion, I just noticed the KeyInfo stuff.

I'll do what you suggest.

Thanks @benoist

[benoist]

Did you manage to get it working?

[luis-cbqa]

Yes, I did, your solution worked perfectly!

[luis-cbqa]

I just had to add a '#' to the uri

encrypted_data.set_key_retrieval_method (Xmlenc::Builder::RetrievalMethod.new(uri: "##{key_name}"))

and add the same key_name to the encrypted key id

encrypted_key.id = key_name

resulting in:

def encrypt_assertion(assertion, key_descriptor_or_certificate)
        case key_descriptor_or_certificate
          when OpenSSL::X509::Certificate
            certificate = key_descriptor_or_certificate
            key_name    = "fd29bfcb991da2e156d1383a165b0f5705b18a49" #This is just a random number it will be anything :)
          when Saml::Elements::KeyDescriptor
            certificate = key_descriptor_or_certificate.certificate
            key_name    = key_descriptor_or_certificate.key_info.key_name
          else
            fail ArgumentError, "Expecting Certificate or KeyDescriptor got: #{key_descriptor_or_certificate.class}"
        end

        assertion = assertion.to_xml(nil, nil, false) if assertion.is_a?(Saml::Assertion) # create xml without instruct

        encrypted_data = Xmlenc::Builder::EncryptedData.new
        encrypted_data.set_key_retrieval_method (Xmlenc::Builder::RetrievalMethod.new(uri: "##{key_name}"))
        encrypted_data.set_encryption_method(algorithm: 'http://www.w3.org/2001/04/xmlenc#aes128-cbc')

        encrypted_key = encrypted_data.encrypt(assertion.to_s)
        encrypted_key.set_encryption_method(algorithm:               'http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p',
                                            digest_method_algorithm: 'http://www.w3.org/2000/09/xmldsig#sha1')

        encrypted_key.id = key_name
        encrypted_key.encrypt(certificate.public_key)

        Saml::Elements::EncryptedAssertion.new(encrypted_data: encrypted_data, encrypted_keys: encrypted_key)
      end