The mailing list for users of the eduroam Configuration Assistant Tool (CAT)

[Miroslav Milinovic <address@concealed>]

Matthew,

we'll see how to accommodate your request and let you know once we've
done it.

Regards

Miroslav Milinovic
eduroam service manager, GEANT

On 31-Jul-20 10:55, Matthew Slowe wrote:
> On 28 Jul 2020, at 10:18, Matthew Slowe <address@concealed> wrote:
>>
>> On behalf of a new CAT member organisation, they're having trouble 
>> authenticating to the CAT Admin portal. SimpleSAMLphp is returning an 
>> error "Failed to decrypt XML element". We've checked the logs on the IdP 
>> (look ok) and can access the UK Federation's Test SP ok, too.
>>
>> SimpleSAML_Error_Error: UNHANDLEDEXCEPTION
>> ...
>> Caused by: Exception: Failed to decrypt XML element.
>>
>> The tracking code was 5d4e392eee at about 08:53Z today.
>>
>> Is this something at the SimpleSAMLphp end or something wrong with the 
>> assertion being generated by their IdP?
> 
> Following up my own question, this could be because the IdP is a new 
> Shibboleth v4 which is using AES-GCM encryption rather than the older 
> AES-CBC and SimpleSAMLphp doesn't know how to decrypt it?
> 
> Could the metadata registration for the CAT SP be updated to include an 
> <EncryptionMethod> element to assert its support options?
> 
> https://docs.oasis-open.org/security/saml/Post2.0/sstc-saml-metadata-algsupport-v1.0-cs01.html#__RefHeading__13608_557150731
> 
> This should instruct IdPs to use the correct algorithm rather than the new 
> default in ShibIdP4.
> 
> Thanks,
>