0

I'm trying to build utility that accepts an encrypted/encoded string containing a SAML 2 assertion string and spits out a decrypted/decoded assertion as plaintext.

I've seen several code examples of decrypting an encrypted/encoded assertion starting from an XML file:

These seem to be built on use of the org.opensaml.xml.io.UnmarshallerFactory, which takes XML inputs rather than string inputs.

Is there an API similar to org.opensaml.xml.io.UnmarshallerFactory that can operate on a string?

Taking the string, injecting it into an XML document, parsing the document, and then using the UnmarshallerFactory seems like a bad idea.

-- Adding this detail:

In an IdP-initiated request, an encoded/encrypted request is being sent into by the IdP to the SP as a form parameter on a POST.

The parameter looks like Base64 encoded string.

I'm looking for a way to decode/decrypt this string to turn it into an Assertion object. The API on the OpenSAML libraries are sufficiently complicated that it isn't obvious how this is done.

I'm looking for a code sample.

Bill
  • 1
  • 1
  • Are you trying to rip a string out of an encoded assertion or something? Why wouldn't you just use a standard SAML library to decrypt the assertion and then pull the string out AFTER it's decrypted? What's the goal, the value? – Andrew K. May 09 '22 at 14:02
  • I updated the request with more information. – Bill May 09 '22 at 14:11
  • Yeah, I don't think your use case makes a whole lot of sense, Bill. To do SAML securely (that is, to ensure that you are only allowing the subject/user that you intend, and that the IdP has authenticated and authorized), you need to do the decryption and signature validation, and, as the SP, it's your responsibility to provide the IdP the public key that they can use to encrypt the response so your private key can decrypt it. If you're "new" to it, I would suggest using a full SP implementation with an open source product like KeyCloak or commercial products like Ping and Okta. – Andrew K. May 09 '22 at 21:17

0 Answers0