调用xmlCipher.doFinal()解密SAML响应未得预期结果求助

Let's break down the potential issues in your code and walk through actionable debugging steps to get your decryption working as expected:

1. First, Fix Your Error Logging (You're Missing Critical Details) #

The biggest issue right now is that you can't see why doFinal() is failing. Your current catch block only logs the error message, but not the full stack trace—this hides context like where exactly the exception is thrown. Update your catch block to capture the full error:

catch (Exception e) {
    LOGGER.error("Error executing decryption: ", e); // Log full stack trace
    // Add a temporary console print to ensure you see the error immediately
    System.err.println("Decryption failed with full trace:");
    e.printStackTrace();
}

Also double-check your logging framework configuration to ensure ERROR level logs are being output correctly.

2. Your Node Traversal Is Fragile (Don't Rely on item(2)) #

Using encryptedDataElement.getChildNodes().item(2) to access the cipher data is risky—XML nodes can include whitespace or comments that shift the index, meaning you might be targeting the wrong node entirely. Replace this with a namespace-aware lookup to reliably find the CipherData element:

// Replace the fragile node traversal with this
NodeList cipherDataNodes = encryptedDataElement.getElementsByTagNameNS(Constants.NS_XENC, "CipherData");
if (cipherDataNodes.getLength() == 0) {
    throw new ValidationError("No CipherData found in EncryptedData element", ValidationError.CIPHERDATA_NOT_FOUND);
}
// You can add a debug log here to confirm you found the right node
LOGGER.debug("Found CipherData node: {}", cipherDataNodes.item(0).getNodeName());

3. Verify Your Key Replacement Logic #

Your code swaps the RetrievalMethod node with the corresponding EncryptedKey, but there are a few gaps here:

• Check the URI parsing: Ensure substring(1) correctly removes the # prefix from the URI, and that the target EncryptedKey's Id matches the parsed value exactly. Add a log to confirm:

  String uri = retrievalMethodElem.getAttribute("URI").substring(1);
  LOGGER.debug("Looking for EncryptedKey with Id: {}", uri);
  

• Confirm the replacement worked: After replacing the node, print the modified EncryptedData XML to ensure the KeyInfo now contains the EncryptedKey instead of RetrievalMethod:

  // Add this after node replacement to verify the XML structure
  TransformerFactory tf = TransformerFactory.newInstance();
  Transformer transformer = tf.newTransformer();
  transformer.setOutputProperty(OutputKeys.OMIT_XML_DECLARATION, "yes");
  StringWriter writer = new StringWriter();
  transformer.transform(new DOMSource(encryptedDataElement), new StreamResult(writer));
  LOGGER.debug("Updated EncryptedData XML:\n{}", writer.toString());
  

4. Fix XMLCipher Initialization Conflicts #

You're initializing XMLCipher with your RSA private key, then calling setKEK(inputKey) again—this is redundant and might confuse the cipher's logic. For SAML decryption, the typical flow is:

1. Use your RSA private key to decrypt the EncryptedKey and retrieve the symmetric key
2. Use that symmetric key to decrypt the EncryptedData

If you want XMLCipher to handle this automatically (via the modified KeyInfo), adjust your initialization to let the cipher resolve the key itself:

XMLCipher xmlCipher = XMLCipher.getInstance();
// Initialize with null, and provide a KeySelector to handle decrypting the EncryptedKey
xmlCipher.init(XMLCipher.DECRYPT_MODE, null, new KeySelector() {
    @Override
    public KeySelectorResult select(KeyInfo keyInfo, Purpose purpose, AlgorithmMethod method, XMLCryptoContext context) throws KeySelectorException {
        // Return your RSA private key to decrypt the EncryptedKey
        return () -> inputKey;
    }
});

5. Validate Inputs #

Before diving deeper, confirm the basics:

• Ensure encryptedDataElement is a valid <EncryptedData> element in the correct namespace (http://www.w3.org/2001/04/xmlenc#).
• Verify your inputKey is a properly loaded RSA private key—print its algorithm and format to confirm:

  LOGGER.debug("Using private key: Algorithm={}, Format={}", inputKey.getAlgorithm(), inputKey.getFormat());
  

Start with the logging fixes first—once you can see the full exception trace, you'll have a clear direction for the next steps.

内容的提问来源于stack exchange，提问作者veeramani