(CkPython) Decrypt a SAML Response

Demonstrates how to decrypt a SAML response.

Note: This example requires Chilkat v9.5.0.76 or greater.

Chilkat Python Downloads install with pip pip3 install chilkat or download... Python Module for Windows, MacOS, Linux, Alpine Linux, Solaris

import sys
import chilkat

#  This example requires the Chilkat API to have been previously unlocked.
#  See Global Unlock Sample for sample code.

#  This example decrypts this SAML response:

#  <?xml version="1.0" encoding="UTF-8" ?>
#  <saml2p:Response Destination="https://deskflow-asp2.com/ubc/ubcdfe.dll/cwlacs" ID="_e4585eaeedbcaf7c24dff7f1ee2499f5" IssueInstant="2018-10-11T17:46:20.727Z" Version="2.0" xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol">
#      <saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">https://authentication.stg.id.ubc.ca</saml2:Issuer>
#      <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
#          <ds:SignedInfo>
#              <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
#              <ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/>
#              <ds:Reference URI="#_e4585eaeedbcaf7c24dff7f1ee2499f5">
#                  <ds:Transforms>
#                      <ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
#                      <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
#                  </ds:Transforms>
#                  <ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
#                  <ds:DigestValue>1ui22tqFyYEOoWI19CMwz4n+ynxNjLDGdTeRMdi60EU=</ds:DigestValue>
#              </ds:Reference>
#          </ds:SignedInfo>
#          <ds:SignatureValue>ROg7FXV6vsp8socVhdo76/i7cRHGGKIveAiScKdujZT0QrHVqIvvbZ/RnwvEMJ9H9i/kJFAQA171
#  		Eo2kDjSdvNFQ/YcKaJUwMtAwT05yVatGV42RZKEf7ME+vpcCTR1LWZdrhat1FWCg1MNQwNWB0EL5
#  		fEP2a4jAcSTB8tFbjTAHsv7IWC39E5RVv99mACYXLa7iGZLtORANZxgYu5qQgmH6pUkI6Z1cpmf+
#  		m9mIjKM6LF0EvLfWOBWL6udZ+GsHPOLjVTJg+1S0xb9FQCYDVW1QhbjSS0icKHKTNNbrsaxllVDY
#  		m4q27YQjRh+XxugPgvsZ61Pxlto8Jbg+6jUlMQ==</ds:SignatureValue>
#          <ds:KeyInfo>
#              <ds:X509Data>
#                  <ds:X509Certificate>MIIDTTCCAjWgAwIBAgIVAJccYyIV6wly8XyddumpgnHMJ2JLMA0GCSqGSIb3DQEBCwUAMCcxJTAj
#  			BgNVBAMMHGF1dGhlbnRpY2F0aW9uLnN0Zy5pZC51YmMuY2EwHhcNMTcwMzAxMTk1NDM0WhcNMzcw
#  			...
#  			xUuh6HuHKIwQqHBz7udxbH3Zbb6jXGDJjiDHt1LRJ8xbVisFIcDlIwsGQQi0HeEJfx4P</ds:X509Certificate>
#              </ds:X509Data>
#          </ds:KeyInfo>
#      </ds:Signature>
#      <saml2p:Status>
#          <saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/>
#      </saml2p:Status>
#      <saml2:EncryptedAssertion xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">
#          <xenc:EncryptedData Id="_314d80b9cf02d8eda8d686a6ffd626cf" Type="http://www.w3.org/2001/04/xmlenc#Element" xmlns:xenc="http://www.w3.org/2001/04/xmlenc#">
#              <xenc:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#aes128-cbc" xmlns:xenc="http://www.w3.org/2001/04/xmlenc#"/>
#              <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
#                  <xenc:EncryptedKey Id="_d7b6da6fb59a627ebb4a96928441ab79" Recipient="https://ubcdfe.deskflow-asp2.com" xmlns:xenc="http://www.w3.org/2001/04/xmlenc#">
#                      <xenc:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p" xmlns:xenc="http://www.w3.org/2001/04/xmlenc#">
#                          <ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" xmlns:ds="http://www.w3.org/2000/09/xmldsig#"/>
#                      </xenc:EncryptionMethod>
#                      <ds:KeyInfo>
#                          <ds:X509Data>
#                              <ds:X509Certificate>MIICuzCCAiQCCQD3bpigRnKMSzANBgkqhkiG9w0BAQsFADCBoTELMAkGA1UEBhMCQ0ExEDAOBgNV
#  				BAgMB09udGFyaW8xEDAOBgNVBAcMB1Rvcm9udG8xJjAkBgNVBAoMHVRhY3RpY2FsIEJ1c2luZXNz
#  				...
#  				kVRcHd1UK3q7G8FoykWjdQz/0EoMTfEZ+Md56mLOe48eMUZV2ONZuL1kDCEKw1UwkaDQI4Pf8pzx
#  				82b9rgw9wBDtvu5eFPlUGEGIBw==</ds:X509Certificate>
#                          </ds:X509Data>
#                      </ds:KeyInfo>
#                      <xenc:CipherData xmlns:xenc="http://www.w3.org/2001/04/xmlenc#">
#                          <xenc:CipherValue>BNHfUOpgdPE5BgpN2VIZIDthMAv1rxk91qVnWyCZOG9bmUKChJtTUqMpndot7VJwYuyKFshkAdnT
#  				D79KGdlSA1xHKcVeZXXzDWglqSyYjzhDCsyOhPaI4HelMFgCLwyFz89uEpUpqlvfl8ol3Am/XnzQ
#  				Vp7V7oS76hocjUI51Qs=</xenc:CipherValue>
#                      </xenc:CipherData>
#                  </xenc:EncryptedKey>
#              </ds:KeyInfo>
#              <xenc:CipherData xmlns:xenc="http://www.w3.org/2001/04/xmlenc#">
#                  <xenc:CipherValue>R6l7tmbnXrOfBgB8lA3KnwLYsLH5ZO5omQ7Hp5K05atzw2o55xmCXVMYhNneFxMtxUh6raEyHeZX
#  			PTZNgWrvdqc4GYND/R7MhRrJzk9OAq1WyoOXwbtRpwNDwWA4N2IuprPQJbvjVxaw/PesZMZwZqlp
#  			...
#  			zm9zAxahyu8Ooe8M4r3HN2cY0JxxxkZtDiulbnyA+rRtXfBRJtangvFQ4iFAnzM/Yg9hMyW9jcu0
#  			S7FzuRB9ONMxi+nh0IFWgqp+</xenc:CipherValue>
#              </xenc:CipherData>
#          </xenc:EncryptedData>
#      </saml2:EncryptedAssertion>
#  </saml2p:Response>

#  The sample encrypted SAML response and RSA private key are available online:
http = chilkat.CkHttp()
sbSamlResponse = chilkat.CkStringBuilder()
sbPrivateKeyPem = chilkat.CkStringBuilder()
success = http.QuickGetSb("https://chilkatdownload.com/data/samlresponse.xml",sbSamlResponse)
if (success == True):
    success = http.QuickGetSb("https://chilkatdownload.com/data/samlresponse_privkey.pem",sbPrivateKeyPem)

if (success != True):
    print(http.lastErrorText())
    sys.exit()

xml = chilkat.CkXml()
xml.LoadSb(sbSamlResponse,True)

#  Load the RSA private key..
privkey = chilkat.CkPrivateKey()
success = privkey.LoadPem(sbPrivateKeyPem.getAsString())
if (success != True):
    print(privkey.lastErrorText())
    sys.exit()

#  Prepare an RSA object w/ the private key...
rsa = chilkat.CkRsa()
success = rsa.ImportPrivateKeyObj(privkey)
if (success != True):
    print(rsa.lastErrorText())
    sys.exit()

#  RSA will be used to decrypt the xenc:EncryptedKey
#  The bytes to be decrypted are in xenc:CipherValue (in base64 format)
encryptedAesKey = xml.getChildContent("saml2:EncryptedAssertion|xenc:EncryptedData|ds:KeyInfo|xenc:EncryptedKey|xenc:CipherData|xenc:CipherValue")
if (xml.get_LastMethodSuccess() != True):
    print("Encrypted AES key not found.")
    sys.exit()

print("Encrypted AES key (base64) = " + encryptedAesKey)

bdAesKey = chilkat.CkBinData()
bdAesKey.AppendEncoded(encryptedAesKey,"base64")

sbRsaAlg = chilkat.CkStringBuilder()
sbRsaAlg.Append(xml.chilkatPath("saml2:EncryptedAssertion|xenc:EncryptedData|ds:KeyInfo|xenc:EncryptedKey|xenc:EncryptionMethod|(Algorithm)"))
print("sbRsaAlg contains: " + sbRsaAlg.getAsString())
if (sbRsaAlg.Contains("rsa-oaep",True) == True):
    rsa.put_OaepPadding(True)

#  Note: The DecryptBd method is introduced in Chilkat v9.5.0.76
success = rsa.DecryptBd(bdAesKey,True)
if (success != True):
    print(rsa.lastErrorText())
    sys.exit()

print("Decrypted AES key (hex) = " + bdAesKey.getEncoded("hex"))

#  Get the encrypted XML (in base64) to be decrypted w/ the AES key.
encrypted64 = xml.getChildContent("saml2:EncryptedAssertion|xenc:EncryptedData|xenc:CipherData|xenc:CipherValue")
if (xml.get_LastMethodSuccess() != True):
    print("Encrypted data not found.")
    sys.exit()

bdEncrypted = chilkat.CkBinData()
bdEncrypted.AppendEncoded(encrypted64,"base64")

#  Get the symmetric algorithm:  "http://www.w3.org/2001/04/xmlenc#aes128-cbc"
#  and set the symmetric decrypt properties.
crypt = chilkat.CkCrypt2()
sbAlg = chilkat.CkStringBuilder()
sbAlg.Append(xml.chilkatPath("saml2:EncryptedAssertion|xenc:EncryptedData|xenc:EncryptionMethod|(Algorithm)"))
if (sbAlg.Contains("aes128-cbc",True) == True):
    crypt.put_CryptAlgorithm("aes")
    crypt.put_KeyLength(128)
    crypt.put_CipherMode("cbc")
    #  The 1st 16 bytes of the encrypted data are the AES IV.
    crypt.SetEncodedIV(bdEncrypted.getEncodedChunk(0,16,"hex"),"hex")
    bdEncrypted.RemoveChunk(0,16)

#  Other algorithms, key lengths, etc, can be supported by checking for different Algorithm attribute values..

crypt.SetEncodedKey(bdAesKey.getEncoded("hex"),"hex")

#  AES decrypt...
success = crypt.DecryptBd(bdEncrypted)
if (success != True):
    print(crypt.lastErrorText())
    sys.exit()

#  Get the decrypted XML
decryptedXml = bdEncrypted.getString("utf-8")
print("Decrypted XML:")
print(decryptedXml)

#  The decrypted XML looks like this:

#  <saml2:Assertion xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion" ID="_226e565c548db7986d165d7d969b48b4" IssueInstant="2018-10-11T17:46:20.727Z" Version="2.0">
#  ...
#  ...
#  ...
#  </saml2:Assertion>

xmlAssertion = chilkat.CkXml()
xmlAssertion.LoadXml(decryptedXml)

#  Replace the saml2:EncryptedAssertion XML subtree with the saml2:Assertion XML.
# xmlEncryptedAssertion is a CkXml
xmlEncryptedAssertion = xml.FindChild("saml2:EncryptedAssertion")
xmlEncryptedAssertion.SwapTree(xmlAssertion)

#  The decrypted XML assertion has now replaced the encrypted XML assertion.
#  Examine the fully decrypted XML document:
print("Full XML SAML document with decrypted assertion:")
print(xml.getXml())