Comments (5)
That is possible to do.
Create an encrypted data object before encrypting the data like so:
encrypted_data = Xmlenc::Builder::EncryptedData.new
encrypted_data.set_key_retrieval_method Xmlenc::Builder::RetrievalMethod.new(
uri: "#<key_id>"
)
encrypted_data.set_encryption_method(
algorithm: 'http://www.w3.org/2001/04/xmlenc#aes256-cbc'
)
There is a Util function that can encrypt assertions for you, however it currently does not have the option to add key info.
Line 63 in 7110809
There is also a Util function to encrypt name ids with key info options. This eventually creates an EncryptedData object that contains the key info.
https://github.com/digidentity/libsaml/blob/master/lib/saml/elements/encrypted_id.rb#L40
I suppose the encrypted assertion can be extended to allow these options as well.
In the mean time I'd suggest to use the code from the encrypt_assertion function and add the key_retrieval_method yourself.
from libsaml.
I see, actually I am using the encrypt_assertion method for encrypting the assertion, I just noticed the KeyInfo stuff.
I'll do what you suggest.
Thanks @benoist
from libsaml.
Did you manage to get it working?
from libsaml.
Yes, I did, your solution worked perfectly!
from libsaml.
I just had to add a '#' to the uri
encrypted_data.set_key_retrieval_method (Xmlenc::Builder::RetrievalMethod.new(uri: "##{key_name}"))
and add the same key_name to the encrypted key id
encrypted_key.id = key_name
resulting in:
def encrypt_assertion(assertion, key_descriptor_or_certificate)
case key_descriptor_or_certificate
when OpenSSL::X509::Certificate
certificate = key_descriptor_or_certificate
key_name = "fd29bfcb991da2e156d1383a165b0f5705b18a49" #This is just a random number it will be anything :)
when Saml::Elements::KeyDescriptor
certificate = key_descriptor_or_certificate.certificate
key_name = key_descriptor_or_certificate.key_info.key_name
else
fail ArgumentError, "Expecting Certificate or KeyDescriptor got: #{key_descriptor_or_certificate.class}"
end
assertion = assertion.to_xml(nil, nil, false) if assertion.is_a?(Saml::Assertion) # create xml without instruct
encrypted_data = Xmlenc::Builder::EncryptedData.new
encrypted_data.set_key_retrieval_method (Xmlenc::Builder::RetrievalMethod.new(uri: "##{key_name}"))
encrypted_data.set_encryption_method(algorithm: 'http://www.w3.org/2001/04/xmlenc#aes128-cbc')
encrypted_key = encrypted_data.encrypt(assertion.to_s)
encrypted_key.set_encryption_method(algorithm: 'http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p',
digest_method_algorithm: 'http://www.w3.org/2000/09/xmldsig#sha1')
encrypted_key.id = key_name
encrypted_key.encrypt(certificate.public_key)
Saml::Elements::EncryptedAssertion.new(encrypted_data: encrypted_data, encrypted_keys: encrypted_key)
end
from libsaml.
Related Issues (20)
- what should be the identity id with uri in idp and sp HOT 4
- Provide access to ResponseLocation property HOT 2
- Sign using SHA1 HOT 6
- xmldsig dependency issue HOT 6
- SOAP binding not checking for WantAuthnRequestsSigned HOT 1
- Support multiple entity descriptors in metadata when using Url ProviderStore HOT 1
- chomp vs gsub("\n", "") on Base64 encoding HOT 2
- Help sought on “Digest value” & “Signature value” HOT 2
- ECP profile support? HOT 7
- Support for SAML responses where only the assertion is signed HOT 2
- Support version of rails <= 4.2 HOT 1
- Onelogin: undefined method `canonicalize' for nil:NilClass HOT 18
- Questions about documentation HOT 20
- Azure AADSTS700016: Application with identifier 'https://sts.windows.net/xxxx-xxxx-xxxx/' was not found in the directory 'xxxx-xxxx-xxxx'. HOT 6
- Question about SAML Response validation HOT 1
- Redundant use of XmlMini_REXML HOT 2
- Add element SessionNotOnOrAfter HOT 1
- RSpec fails after upgrading(`~> 1.8`) gem `nokogiri`.
- Signature verification with multiple certificates when validating SAML responses HOT 2
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from libsaml.