Seems to produce SamlResponses which are against XML encryption specification
Description
Environment
Activity
Sami Karvonen July 8, 2024 at 1:46 PM
Ok, Thanks for your help. Atleast, now I know where the problem is.
Scott Cantor July 8, 2024 at 1:41 PM
We intend to update to 3.0.5 when it’s available but that will depend on them, and we don’t know when a future IdP release may be coming, so I wouldn’t expect it for a while. If you need it now, you’d have to do your own build.
Sami Karvonen July 8, 2024 at 1:34 PM
Well, the problem is not directly with the HSM. But with selecting the correct provider.
This: https://github.com/apache/santuario-xml-security-java/commit/3c934711c97c9f60a45268051ac2315e9b41f8c2
Scott Cantor July 8, 2024 at 1:27 PM
There is no other version released, 3.0.4 was the latest on that branch and it contains the bug.
I can’t see how Santuario would care about your HSM it doesn’t interface to them natively as far as I know.
Sami Karvonen July 8, 2024 at 1:17 PM
Yes, that seems to be the problem. Thanks for your help!
We had to change the xmlsec version to 3.0.4 because of a diffrent bug in version 3.0.3 which created a problem with our HSM. This is a bit problematic since we can’t use either of those version. But atleast, I now know where the problem is.
Is there any chance idp would work with any other version on xmlsec?
I upgraded our idp from 4.x to 5.1.2 and noticed afterwards a small change in the SamlResponses the idp produces. Specifically in the EncryptionMethod of EncryptedKey. Before the upgrade it looks like this:
<xenc:EncryptionMethod xmlns:xenc="http://www.w3.org/2001/04/xmlenc#" Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p" > <ds:DigestMethod xmlns:ds="http://www.w3.org/2000/09/xmldsig#" Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /> </xenc:EncryptionMethod>And after the upgrade it looks like this:
<xenc:EncryptionMethod xmlns:xenc="http://www.w3.org/2001/04/xmlenc#" Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p" > <ds:DigestMethod xmlns:ds="http://www.w3.org/2000/09/xmldsig#" Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /> <xenc11:MGF xmlns:xenc11="http://www.w3.org/2009/xmlenc11#" Algorithm="http://www.w3.org/2009/xmlenc11#mgf1sha1" /> </xenc:EncryptionMethod>The addition of xenc11:MGF seems to be against the XML encryption 1.1 spec (https://www.w3.org/TR/xmlenc-core1/#sec-RSA-OAEP) which states:
"The http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p identifier defines the mask generation function as the fixed value of MGF1 with SHA1. In this case the optional xenc11:MGF element of the xenc:EncryptionMethod element MUST NOT be provided."
Is this a bug or have I misconfigured something while upgrading the idp?