No installed provider supports this key: com.rsa.cryptoj.o.eg error during SAML authentication

Veena_07​ Any help here?

See our new end to end SAML Article that shows a real world example -- Integrating SAML with Adobe Experience Manager

The IdP certificate is not a valid one as the SAML Auth Handler is trying to validate the SAML Response against the certificate added into the AEM trust store.

Please correct the certificate and you should not see this issue.

same can be seen the API as well

  private boolean verifySignatures(Element parentElement, Element signedElement, Key publicKey)

  {

    if (publicKey != null)

    {

      NodeList signatureNodes = signedElement.getElementsByTagNameNS("http://www.w3.org/2000/09/xmldsig#", "Signature");

      if (signatureNodes.getLength() == 0)

      {

        this.log.warn("Received SAML message without signature element.");

        return false;

      }

      for (int j = 0; j < signatureNodes.getLength(); j++) {

        try

        {

          DOMValidateContext valContext = new DOMValidateContext(publicKey, signatureNodes.item(j));

          valContext.setIdAttributeNS(signedElement, null, "ID");

          valContext.setIdAttributeNS(parentElement, null, "ID");

          String providerName = System.getProperty("jsr105Provider", "org.apache.jcp.xml.dsig.internal.dom.XMLDSigRI");

          XMLSignatureFactory sigFactory = XMLSignatureFactory.getInstance("DOM", (Provider)Class.forName(providerName).newInstance());

          XMLSignature signature = sigFactory.unmarshalXMLSignature(valContext);

          if (!signature.validate(valContext)) {

            return false;

          }

        }

        catch (MarshalException e)

        {

          this.log.error("Could not unmarshal XML signature.", e);

          return false;

        }

        catch (XMLSignatureException e)

        {

          this.log.error("Failed validating signature.", e);

          return false;

        }

        catch (ClassNotFoundException e)

        {

          this.log.error("Failed obtaining the signature provider: ", e);

          return false;

        }

        catch (InstantiationException e)

        {

          this.log.error("Failed obtaining the signature provider: ", e);

          return false;

        }

        catch (IllegalAccessException e)

        {

          this.log.error("Failed obtaining the signature provider: ", e);

          return false;

        }

      }

    }

    else

    {

      this.log.warn("Could not verify signatures. Public key of IdP not provided.");

      return false;

    }

    return true;

  }

As you can see it is trying to validate against IdP certificate which is causing the error.

what i understand is error is while validating the signature only. for me it seems to be some JDK related issue. I have cross checked the certifcate and it is correct only.

1. 14.03.2018 03:01:59.223 *ERROR* [qtp-1211009574-2288] com.adobe.granite.auth.saml.util.SamlReader Failed validating signature. 
2. javax.xml.crypto.dsig.XMLSignatureException: java.security.InvalidKeyException: No installed provider supports this key: com.rsa.cryptoj.o.eg 
3.         at org.apache.jcp.xml.dsig.internal.dom.DOMXMLSignature$DOMSignatureValue.validate(DOMXMLSignature.java:565) 

I do not believe this is a jar issue.  I think the encryption used by the IdP is different from the one provided to you.

https://examples.javacodegeeks.com/core-java/security/invalidkeyexception/java-security-invalidkeyexception-how-to-solve…

Again this is also a hunch as I am not exactly sure why this is happening.

I tried updating local_policy.jar and US_export_policy.jar jars also but no luck. I am still getting the same exception.

No kautuksahni​ I have not worked with SAML . I am sorry for not being much help here

There is a lot of useful information here. Can you please close off this thread.

again, this would be the issue with the encryption used by the IdP to sign the assertion. I would recommend, you ask the IdP about which encryption they are using.