Error/Exception 在整理已签名和加密的响应 OpenSAML v3 时

Question

我使用 OpenSaml V2 有一段时间了，效果很好，我最近开始迁移。由于缺乏信息，即使是从我最近购买的 OpenSaml V3 书中，我也遇到了一些问题，一些在 V2 上运行良好的东西。

我一直在用下面的方法来加密Assertion。这个方法好像没问题。

    private EncryptedAssertion createEncryptedAssertion(Assertion assertion) throws SamlException {

    try {
        Credential keyEncryptionCredential = CredentialSupport.getSimpleCredential(this.encryptingCertificate, this.encryptingPrivateKey);

        DataEncryptionParameters encryptionParameters = new DataEncryptionParameters();
        encryptionParameters.setAlgorithm(EncryptionConstants.ALGO_ID_BLOCKCIPHER_AES128);

        KeyEncryptionParameters keyEncryptionParameters = new KeyEncryptionParameters();
        keyEncryptionParameters.setEncryptionCredential(keyEncryptionCredential);
        keyEncryptionParameters.setAlgorithm(EncryptionConstants.ALGO_ID_KEYTRANSPORT_RSAOAEP);

        Encrypter samlEncrypter = new Encrypter(encryptionParameters, keyEncryptionParameters);
        samlEncrypter.setKeyPlacement(Encrypter.KeyPlacement.INLINE);

        return samlEncrypter.encrypt(assertion);
    }
    catch(Exception e) {
        throw new SamlException(e);
    }
}

当我尝试使用以下方法将我的响应与加密断言编组时，我遇到了这个问题：

    public String marshall(XMLObject xmlObject, boolean encode) throws SamlException {

    try {

        ParserPool parserPool = XMLObjectProviderRegistrySupport.getParserPool();
        MarshallerFactory marshallerFactory = XMLObjectProviderRegistrySupport.getMarshallerFactory();
        Marshaller marshaller = marshallerFactory.getMarshaller(xmlObject);
        if(marshaller == null) {
            throw new SamlException("Unable to locate marshaller for " + xmlObject.getElementQName()
                                 + " can not perform marshalling operation");
        }

        Element element = marshallerFactory.getMarshaller(xmlObject).marshall(xmlObject, parserPool.newDocument());

        Transformer transformer = TransformerFactory.newInstance().newTransformer();
        transformer.setOutputProperty(OutputKeys.INDENT, "yes");
        transformer.setOutputProperty("{http://xml.apache.org/xslt}indent-amount", "3");

        StreamResult result = new StreamResult(new StringWriter());
        DOMSource source = new DOMSource(element);

        transformer.transform(source, result);
        String xmlString = result.getWriter().toString();

        if(encode) {
            //return Util.base64EncodeMessage(xmlString);
        }
        return xmlString;
    }
    catch(Exception e) {
        throw new SamlException(e);
    }
}

当我尝试用加密断言编组我的响应时，出现以下异常：

Caused by: org.opensaml.core.xml.io.MarshallingException: Unable to root namespaces of cached DOM element, {http://www.w3.org/2001/04/xmlenc#}EncryptionMethod
at org.opensaml.core.xml.io.AbstractXMLObjectMarshaller.prepareForAdoption(AbstractXMLObjectMarshaller.java:427)
at org.opensaml.core.xml.io.AbstractXMLObjectMarshaller.marshall(AbstractXMLObjectMarshaller.java:144)
at org.opensaml.core.xml.io.AbstractXMLObjectMarshaller.marshallChildElements(AbstractXMLObjectMarshaller.java:271)
at org.opensaml.core.xml.io.AbstractXMLObjectMarshaller.marshallInto(AbstractXMLObjectMarshaller.java:212)
at org.opensaml.core.xml.io.AbstractXMLObjectMarshaller.marshall(AbstractXMLObjectMarshaller.java:162)
at org.opensaml.core.xml.io.AbstractXMLObjectMarshaller.marshallChildElements(AbstractXMLObjectMarshaller.java:271)
at org.opensaml.core.xml.io.AbstractXMLObjectMarshaller.marshallInto(AbstractXMLObjectMarshaller.java:212)
at org.opensaml.core.xml.io.AbstractXMLObjectMarshaller.marshall(AbstractXMLObjectMarshaller.java:162)
at org.opensaml.core.xml.io.AbstractXMLObjectMarshaller.marshallChildElements(AbstractXMLObjectMarshaller.java:271)
at org.opensaml.core.xml.io.AbstractXMLObjectMarshaller.marshallInto(AbstractXMLObjectMarshaller.java:212)
at org.opensaml.core.xml.io.AbstractXMLObjectMarshaller.marshall(AbstractXMLObjectMarshaller.java:162)
at org.opensaml.core.xml.io.AbstractXMLObjectMarshaller.marshallChildElements(AbstractXMLObjectMarshaller.java:271)
at org.opensaml.core.xml.io.AbstractXMLObjectMarshaller.marshallInto(AbstractXMLObjectMarshaller.java:212)
at org.opensaml.core.xml.io.AbstractXMLObjectMarshaller.marshall(AbstractXMLObjectMarshaller.java:162)
at org.opensaml.saml.common.AbstractSAMLObjectMarshaller.marshall(AbstractSAMLObjectMarshaller.java:65)
at org.opensaml.core.xml.io.AbstractXMLObjectMarshaller.marshallChildElements(AbstractXMLObjectMarshaller.java:271)
at org.opensaml.core.xml.io.AbstractXMLObjectMarshaller.marshallInto(AbstractXMLObjectMarshaller.java:212)
at org.opensaml.core.xml.io.AbstractXMLObjectMarshaller.marshall(AbstractXMLObjectMarshaller.java:118)
at org.opensaml.saml.common.AbstractSAMLObjectMarshaller.marshall(AbstractSAMLObjectMarshaller.java:57)
at com.divinvest.sso.opensaml.SamlAssertionProducerV2.marshall(SamlAssertionProducerV2.java:171)
... 25 more
Caused by: org.w3c.dom.DOMException: Unable to resolve namespace prefix ds found on element {http://www.w3.org/2000/09/xmldsig#}DigestMethod
at net.shibboleth.utilities.java.support.xml.NamespaceSupport.rootNamespaces(NamespaceSupport.java:247)
at net.shibboleth.utilities.java.support.xml.NamespaceSupport.rootNamespaces(NamespaceSupport.java:295)
at net.shibboleth.utilities.java.support.xml.NamespaceSupport.rootNamespaces(NamespaceSupport.java:200)
at org.opensaml.core.xml.io.AbstractXMLObjectMarshaller.prepareForAdoption(AbstractXMLObjectMarshaller.java:422)
... 44 more

我在 unmarshall 方法中遗漏了什么吗？我正在用签名断言、签名响应编组我的响应对象，但是当断言被加密时，我无法做到。

谢谢

Answer 1

问题是 xmltooling 带来了错误的 xmlsec 版本 (1.5.7)，我必须包含一个排除项才能使用 opensaml-security-api 使用的 xmlsec 2.0.5。

Error/Exception 在整理已签名和加密的响应 OpenSAML v3 时

Error/Exception while marshalling signed and encrypted response OpenSAML v3

opensaml