After spending one week debugging and searching on Google, I decided to fix this problem with a small hack.
I checked the Spring -Saml source code from the main branch of the gitHub repository and built a jar and imported it into my project. I thought this SES-144 question was similar to mine, so I tried with the latest code, but no luck.
So, I decided to debug the xmlTooling.jar code and find the exact point of failure and rewrite the decryptKey(EncryptedKey encryptedKey, String algorithm) method decryptKey(EncryptedKey encryptedKey, String algorithm) below in XMLCipher.java using the code below.
Cipher c = constructCipher(encryptedKey.getEncryptionMethod() .getAlgorithm(), encryptedKey.getEncryptionMethod() .getDigestAlgorithm()); Instead of calling c.init(4, key, oaepParameters); used below code and removed if/else block c.init(4, key);
You can check custom banks from github
You need to update your saml dependency with the following lines in the pom.xml file to use this custom jar
<dependency> <groupId>org.springframework.security.extensions</groupId> <artifactId>spring-security-saml2-core</artifactId> <version>1.0.1.RELEASE</version> <exclusions> <exclusion> <artifactId>xmlsec</artifactId> <groupId>org.apache.santuario</groupId> </exclusion> </exclusions> </dependency> <dependency> <artifactId>xmlsec</artifactId> <groupId>org.apache.santuario</groupId> <version>1.5.6-custom</version> </dependency>
If anyone finds a better solution, please let me know.
Manojp
source share