SES-46: Encrypted assertions ignored in SAML reply

[spring-projects-issues]

Rob Moore (Migrated from SES-46) said:

The current implementation does not check for encrypted assertions. In the case where the SAML reply is encrypted this means that no assertions are found. The code checks for encrypted values in other cases so this leads to unexpected behavior as it appears as if no assertion was found in the response when really the assertion was simply encrypted.

Rather than simply calling response.getAssertions() alone one approach would also call response.getEncryptedAssertions() and add the decrypted assertions to the list returned from the first call (assuming it's modifiable otherwise a fresh, independent list could be created). This two pass approach seems consistent with existing code (see attributes are handled in the code in WebSSOProfileConsumer.processResponse()).

[spring-projects-issues]

Rob Moore said:

Providing patch based on the fix in previous comments.

[spring-projects-issues]

Rob Moore said:

Looks like this is required to for signature to pass verification.

[spring-projects-issues]

Rob Moore said:

A point of reference regarding the second patch:

http://groups.google.com/group/opensaml-users/browse_thread/thread/efd63a580600fcac

[spring-projects-issues]

Vladimir Schäfer said:

Thanks for the patch Rob.