title: Decrypting SAML2 response using pysaml2 Python module
body: <p>I am integrating my app with okta to have single sign on. Okta will be passing some user information in SAML response which I need to use in my application.
  Hence, we decided to encrypt the saml response(xml) at IDP using my server(apache)  public key.</p>
  
  <p>Now I am trying to decrypt the saml2 response so that I can get the attributes.</p>
  
  <p>My applications uses</p>
  
  <ol>
  <li><p>Python 3.5</p></li>
  <li><p>Django 1.11</p></li>
  <li><p>pysaml2 python module</p></li>
  </ol>
  
  <p>I am using below to validate/parse the saml2 response coming from okta
  <a href="https://github.com/fangli/django-saml2-auth" rel="nofollow noreferrer">https://github.com/fangli/django-saml2-auth</a></p>
  
  <p>If the saml response is not encrypted, I am able to process the response and able to get the user identity and user attributes from it.
  However once it is encrypted at okta end with my server public key, I am not able to decrypt with my private key.</p>
  
  <p>The saml setting I have at my application is below : </p>
  
  <pre><code>saml_settings = { 'metadata': {
                   "local": [ metadat_xml
                ],           
  },
  'service': {
      'sp': {
          'endpoints': {
              'assertion_consumer_service': [
                  (acs_url, BINDING_HTTP_REDIRECT),
                  (acs_url, BINDING_HTTP_POST),
                  (https_acs_url, BINDING_HTTP_REDIRECT),
                  (https_acs_url, BINDING_HTTP_POST)
              ],
          },
          'allow_unsolicited': True,
          'authn_requests_signed': False,
          'logout_requests_signed': True,
          'want_assertions_signed': True,
          'want_response_signed': False,
      },
  },
  
  'key_file': "mykey.key",  # private part
  'cert_file': "mykey.crt",  # public part
  'xmlsec_binary': '/usr/bin/xmlsec1',
  'encryption_keypairs': [{
      'key_file': 'mykey.key',
      'cert_file': 'mykey.crt',
         }]
        }
       if 'ENTITY_ID' in settings.SAML2_AUTH:
      saml_settings['entityid'] = settings.SAML2_AUTH['ENTITY_ID']
  
  #print('entity id ' , settings.SAML2_AUTH['ENTITY_ID'])
  
  if 'NAME_ID_FORMAT' in settings.SAML2_AUTH:
      saml_settings['service']['sp']['name_id_format'] = settings.SAML2_AUTH['NAME_ID_FORMAT']
  
  # NOTE-'NAME_ID_FORMAT is set to None above
  
  spConfig = Saml2Config()
  
  spConfig.load(saml_settings)
  spConfig.allow_unknown_attributes = True
  saml_client = Saml2Client(config=spConfig)
  return saml_client
  </code></pre>
  
  <p>Then I have</p>
  
  <pre><code>saml_client = _get_saml_client(get_current_domain(r))
  resp = r.POST.get('SAMLResponse', None)
  authn_response = saml_client.parse_authn_request_response(resp, entity.BINDING_HTTP_POST )
  </code></pre>
  
  <p><strong>This auth_response object is not returning me anything when the message is encrypted.</strong></p>
  
  <p>In logs I see below error</p>
  
  <pre><code>GbHvkJJM0WIsPYFGtiQ/0n+ux0tV/z/OKpT1AqEE74iRVHEHD7omP41iY/c4= 
  &lt;/ns3:CipherValue&gt;&lt;/ns3:CipherData&gt;&lt;ns3:ReferenceList&gt;&lt;ns3:DataReference 
  URI="#_648cdbd139564492f0bdfe4fbbda92f6" /&gt;&lt;/ns3:ReferenceList&gt; 
  &lt;/ns3:EncryptedKey&gt;&lt;/ns1:EncryptedAssertion&gt;&lt;/ns0:Response&gt;
  2018-04-30 18:21:09,232 [DEBUG] sigver saml2.sigver decrypt(): Decrypt input 
  len: 15187
  2018-04-30 18:21:09,233 [DEBUG] sigver saml2.sigver _run_xmlsec(): xmlsec 
  command: /usr/bin/xmlsec1 --decrypt --privkey-pem 
  /private.pem --id-attr:ID EncryptedKey --output /tmp/tmp7rt7g95u.xml 
  /tmp/tmpkhxwo8s4
  2018-04-30 18:21:09,247 [DEBUG] sigver saml2.sigver _run_xmlsec(): xmlsec 
  p_out:
  2018-04-30 18:21:09,247 [DEBUG] sigver saml2.sigver _run_xmlsec(): xmlsec 
  p_erryy: 
  func=xmlSecXPathDataExecute:file=xpath.c:line=273:obj=unknown:
  subj=xmlXPtrEval:error=5:libxml2 library function 
  failed:expr=xpointer(id('_841612fffac65343e73f8913eeecfb30'))
  func=xmlSecXPathDataListExecute:file=xpath.c:line=373:obj=unknown:
  subj=xmlSecXPathDataExecute:error=1:xmlsec library function failed:
  func=xmlSecTransformXPathExecute:file=xpath.c:line=483:
  obj=xpointer:subj=xmlSecXPathDataExecute:error=1:xmlsec library function 
  failed:
  func=xmlSecTransformDefaultPushXml:file=transforms.c:
  line=2411:obj=xpointer:subj=xmlSecTransformExecute:error=1:xmlsec library 
  function failed:
  func=xmlSecTransformCtxExecute:file=transforms.c:line=1302:
  obj=unknown:subj=xmlSecTransformCtxXmlExecute:error=1:xmlsec library 
  function failed:
  func=xmlSecKeyDataRetrievalMethodXmlRead:file=keyinfo.c:line=1178:
  obj=retrieval-method:subj=xmlSecTransformCtxExecute:error=1:xmlsec library 
  function failed:
  func=xmlSecKeyInfoNodeRead:file=keyinfo.c:line=114:obj=retrieval-method:
  subj=xmlSecKeyDataXmlRead:error=1:xmlsec library function 
  failed:node=RetrievalMethod
  func=xmlSecKeysMngrGetKey:file=keys.c:line=1349:obj=unknown:
  subj=xmlSecKeyInfoNodeRead:error=1:xmlsec library function 
  failed:node=KeyInfo
  func=xmlSecEncCtxEncDataNodeRead:file=xmlenc.c:line=957:
  obj=unknown:subj=unknown:error=45:key is not found:
  func=xmlSecEncCtxDecryptToBuffer:file=xmlenc.c:line=715:
  obj=unknown:subj=xmlSecEncCtxEncDataNodeRead:error=1:xmlsec library function 
  failed:
  func=xmlSecEncCtxDecrypt:file=xmlenc.c:line=623:
  obj=unknown:subj=xmlSecEncCtxDecryptToBuffer:error=1:xmlsec library function 
  failed:
  
  Error: failed to decrypt file
  Error: failed to decrypt file "/tmp/tmpkhxwo8s4"
  </code></pre>
  
  <p>I am not sure why xmlsec1 command is failing and what I am missing here.
  I have tried decrypting with my private key(self signed private key) here
  <a href="https://www.samltool.com/decrypt.php" rel="nofollow noreferrer">https://www.samltool.com/decrypt.php</a>
  and it works</p>
  
  <p><strong>Could you please help me here and let me know what I am not doing correctly?</strong> </p>