search

swedenconnect / bankid-saml-idp

A SAML IdP for BankID
https://www.swedenconnect.se
Apache License 2.0
8 stars 3 forks source link

Use of encrypted private key doesn't work #203

Closed theseal closed 1 year ago

theseal commented 1 year ago

Results in error:

    |#033[0m org.springframework.beans.factory.UnsatisfiedDependencyException: Error creating bean with name 'bankIdAuthenticationController' defined in file [/app/classes/se/swedenconnect/bankid/idp/authn/BankIdAuthenticationController.class]: Unsatisfied dependency expressed
through constructor parameter 0: Error creating bean with name 'relyingPartyRepository' defined in class path resource [se/swedenconnect/bankid/idp/config/BankIdConfiguration.class]: Failed to instantiate [se.swedenconnect.bankid.idp.rp.RelyingPartyRepository]: Factory method 'relyingPartyRepository' threw exception with message: Failed to create bean for webcli
ent supplier
    |#033[0m #011at org.springframework.beans.factory.support.ConstructorResolver.createArgumentArray(ConstructorResolver.java:801)
    |#033[0m #011at org.springframework.beans.factory.support.ConstructorResolver.autowireConstructor(ConstructorResolver.java:240)
    |#033[0m #011at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.autowireConstructor(AbstractAutowireCapableBeanFactory.java:1352)
    |#033[0m #011at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBeanInstance(AbstractAutowireCapableBeanFactory.java:1189)
    |#033[0m #011at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:560)
    |#033[0m #011at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:520)
    |#033[0m #011at org.springframework.beans.factory.support.AbstractBeanFactory.lambda$doGetBean$0(AbstractBeanFactory.java:325)
    |#033[0m #011at org.springframework.beans.factory.support.DefaultSingletonBeanRegistry.getSingleton(DefaultSingletonBeanRegistry.java:234)
    |#033[0m #011at org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:323)
    |#033[0m #011at org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:199)
    |#033[0m #011at org.springframework.beans.factory.support.DefaultListableBeanFactory.preInstantiateSingletons(DefaultListableBeanFactory.java:973)
    |#033[0m #011at org.springframework.context.support.AbstractApplicationContext.finishBeanFactoryInitialization(AbstractApplicationContext.java:942)
    |#033[0m #011at org.springframework.context.support.AbstractApplicationContext.refresh(AbstractApplicationContext.java:608)
    |#033[0m #011at org.springframework.boot.web.servlet.context.ServletWebServerApplicationContext.refresh(ServletWebServerApplicationContext.java:146)
    |#033[0m #011at org.springframework.boot.SpringApplication.refresh(SpringApplication.java:737)
    |#033[0m #011at org.springframework.boot.SpringApplication.refreshContext(SpringApplication.java:439)
    |#033[0m #011at org.springframework.boot.SpringApplication.run(SpringApplication.java:315)
    |#033[0m #011at org.springframework.boot.SpringApplication.run(SpringApplication.java:1309)
    |#033[0m #011at org.springframework.boot.SpringApplication.run(SpringApplication.java:1298)
    |#033[0m #011at se.swedenconnect.bankid.idp.IdpApplication.main(IdpApplication.java:56)
    |#033[0m Caused by: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'relyingPartyRepository' defined in class path resource [se/swedenconnect/bankid/idp/config/BankIdConfiguration.class]: Failed to instantiate [se.swedenconnect.bankid.idp.rp.RelyingPartyRepository]: Factory method 'relyingPartyRepository' threw exception with message: Failed to create bean for webclient supplier
    |#033[0m #011at org.springframework.beans.factory.support.ConstructorResolver.instantiate(ConstructorResolver.java:654)
    |#033[0m #011at org.springframework.beans.factory.support.ConstructorResolver.instantiateUsingFactoryMethod(ConstructorResolver.java:642)
    |#033[0m #011at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.instantiateUsingFactoryMethod(AbstractAutowireCapableBeanFactory.java:1332)
    |#033[0m #011at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBeanInstance(AbstractAutowireCapableBeanFactory.java:1162)
    |#033[0m #011at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:560)
    |#033[0m #011at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:520)
    |#033[0m #011at org.springframework.beans.factory.support.AbstractBeanFactory.lambda$doGetBean$0(AbstractBeanFactory.java:325)
    |#033[0m #011at org.springframework.beans.factory.support.DefaultSingletonBeanRegistry.getSingleton(DefaultSingletonBeanRegistry.java:234)
    |#033[0m #011at org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:323)
    |#033[0m #011at org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:199)
    |#033[0m #011at org.springframework.beans.factory.config.DependencyDescriptor.resolveCandidate(DependencyDescriptor.java:254)
    |#033[0m #011at org.springframework.beans.factory.support.DefaultListableBeanFactory.doResolveDependency(DefaultListableBeanFactory.java:1417)
    |#033[0m #011at org.springframework.beans.factory.support.DefaultListableBeanFactory.resolveDependency(DefaultListableBeanFactory.java:1337)
    |#033[0m #011at org.springframework.beans.factory.support.ConstructorResolver.resolveAutowiredArgument(ConstructorResolver.java:910)
    |#033[0m #011at org.springframework.beans.factory.support.ConstructorResolver.createArgumentArray(ConstructorResolver.java:788)
    |#033[0m #011... 19 common frames omitted
    |#033[0m Caused by: org.springframework.beans.BeanInstantiationException: Failed to instantiate [se.swedenconnect.bankid.idp.rp.RelyingPartyRepository]: Factory method 'relyingPartyRepository' threw exception with message: Failed to create bean for webclient supplier
    |#033[0m #011at org.springframework.beans.factory.support.SimpleInstantiationStrategy.instantiate(SimpleInstantiationStrategy.java:171)
    |#033[0m #011at org.springframework.beans.factory.support.ConstructorResolver.instantiate(ConstructorResolver.java:650)
    |#033[0m #011... 33 common frames omitted
    |#033[0m Caused by: java.lang.RuntimeException: Failed to create bean for webclient supplier
    |#033[0m #011at se.swedenconnect.bankid.idp.config.BankIdConfiguration.lambda$bankIdWebClientFactory$3(BankIdConfiguration.java:154)
    |#033[0m #011at se.swedenconnect.bankid.idp.config.BankIdConfiguration.relyingPartyRepository(BankIdConfiguration.java:186)
    |#033[0m #011at se.swedenconnect.bankid.idp.config.BankIdConfiguration$$SpringCGLIB$$0.CGLIB$relyingPartyRepository$4(<generated>)
    |#033[0m #011at se.swedenconnect.bankid.idp.config.BankIdConfiguration$$SpringCGLIB$$2.invoke(<generated>)
    |#033[0m #011at org.springframework.cglib.proxy.MethodProxy.invokeSuper(MethodProxy.java:258)
    |#033[0m #011at org.springframework.context.annotation.ConfigurationClassEnhancer$BeanMethodInterceptor.intercept(ConfigurationClassEnhancer.java:331)
    |#033[0m #011at se.swedenconnect.bankid.idp.config.BankIdConfiguration$$SpringCGLIB$$0.relyingPartyRepository(<generated>)
    |#033[0m #011at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    |#033[0m #011at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:77)
    |#033[0m #011at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
    |#033[0m #011at java.base/java.lang.reflect.Method.invoke(Method.java:568)
    |#033[0m #011at org.springframework.beans.factory.support.SimpleInstantiationStrategy.instantiate(SimpleInstantiationStrategy.java:139)
    |#033[0m #011... 34 common frames omitted
    |#033[0m Caused by: org.cryptacular.EncodingException: Key encoding error
    |#033[0m #011at org.cryptacular.asn.AbstractPrivateKeyDecoder.decode(AbstractPrivateKeyDecoder.java:31)
    |#033[0m #011at org.cryptacular.util.KeyPairUtil.decodePrivateKey(KeyPairUtil.java:411)
    |#033[0m #011at org.cryptacular.util.KeyPairUtil.readPrivateKey(KeyPairUtil.java:354)
    |#033[0m #011at se.swedenconnect.security.credential.AbstractPkiCredential.setPrivateKey(AbstractPkiCredential.java:186)
    |#033[0m #011at se.swedenconnect.security.credential.BasicCredential.<init>(BasicCredential.java:140)
    |#033[0m #011at se.swedenconnect.security.credential.factory.PkiCredentialFactoryBean.createInstance(PkiCredentialFactoryBean.java:145)
    |#033[0m #011at se.swedenconnect.security.credential.factory.PkiCredentialFactoryBean.createInstance(PkiCredentialFactoryBean.java:55)
    |#033[0m #011at org.springframework.beans.factory.config.AbstractFactoryBean.afterPropertiesSet(AbstractFactoryBean.java:142)
    |#033[0m #011at se.swedenconnect.security.credential.factory.PkiCredentialFactoryBean.afterPropertiesSet(PkiCredentialFactoryBean.java:338)
    |#033[0m #011at se.swedenconnect.bankid.idp.config.BankIdConfigurationProperties$RelyingPartyConfiguration.createCredential(BankIdConfigurationProperties.java:267)
    |#033[0m #011at se.swedenconnect.bankid.idp.config.BankIdConfiguration.lambda$bankIdWebClientFactory$3(BankIdConfiguration.java:149)
    |#033[0m #011... 45 common frames omitted
    |#033[0m Caused by: java.lang.ArrayIndexOutOfBoundsException: Index 1 out of bounds for length 1
    |#033[0m #011at org.cryptacular.asn.OpenSSLPrivateKeyDecoder.decryptKey(OpenSSLPrivateKeyDecoder.java:43)
    |#033[0m #011at org.cryptacular.asn.AbstractPrivateKeyDecoder.decode(AbstractPrivateKeyDecoder.java:23)
    |#033[0m #011... 55 common frames omitted
    |#033[0m

Example configuration

  relying-parties:
    - id: "sunet"
      entity-ids:
       - "https://ladok3-00.ladok.umu.se/student-sp"
       - "https://ladok3-demo-00.its.umu.se/student-sp"
       - "https://release-check.qa.swamid.se/shibboleth"
      credential:
        name: "test-cred"
        certificate: file:/opt/bankidp/config/bankid.cert
        private-key: file:/opt/bankidp/config/bankid.key
        keyPassword: 1234

The key pair is an unpacked version of BankIds FPTestcert4_20230629.p12 with password 1234:

-----BEGIN CERTIFICATE-----
MIIEyjCCArKgAwIBAgIIMLbIMaRHjMMwDQYJKoZIhvcNAQELBQAwcTELMAkGA1UE
BhMCU0UxHTAbBgNVBAoMFFRlc3RiYW5rIEEgQUIgKHB1YmwpMRUwEwYDVQQFEwwx
MTExMTExMTExMTExLDAqBgNVBAMMI1Rlc3RiYW5rIEEgUlAgQ0EgdjEgZm9yIEJh
bmtJRCBUZXN0MB4XDTIyMDgxNzIyMDAwMFoXDTI0MDgxODIxNTk1OVowcjELMAkG
A1UEBhMCU0UxHTAbBgNVBAoMFFRlc3RiYW5rIEEgQUIgKHB1YmwpMRMwEQYDVQQF
Ewo1NTY2MzA0OTI4MRcwFQYDVQQpDA5UZXN0IGF2IEJhbmtJRDEWMBQGA1UEAwwN
RlAgVGVzdGNlcnQgNDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAL4L
8ERHNSi7Jph9gj4ah7Ieok5lZHZbNyW1AiJJ1OfeD1lbAzxSidtTu6NfC83zxCjL
q091lHY5G7dpNDt1rN5Y+jQvrtcLc8nUpgqLfEUnbGKzZaHlO97jh6pqO8nj/mal
TrWI70Fr6SO3SxbsgxuwJXlRUAQxI0mPvD1gOd+uymA+EqdYS39ijC2eICHSf7bU
wvmscy8TAyEcT4GYmcjai1vbIjlhemmAv+NKJiSpD+zqvuHGIzBm71/Fd6cTAXqk
HkqTlJsxF2m6eojKCfcm5uAvSTXhVbGM155wmpzLskzkQ0dx6LbRNtA+BDe1MsAA
v8aE2FQ0j31ALgZePY0CAwEAAaNlMGMwEQYDVR0gBAowCDAGBgQqAwQFMA4GA1Ud
DwEB/wQEAwIHgDAfBgNVHSMEGDAWgBTiuVUIvGKgRjldgAxQSpIBy0zvizAdBgNV
HQ4EFgQUoiM2SwR2MdMVjaZz04J9LbOEau8wDQYJKoZIhvcNAQELBQADggIBAGBA
X1IC7mg1blaeqrTW+TtPkF7GvsbsWIh0RgG9DYRtXXofad3bn6kbDrfFXKZzv4JH
ERmJSyLXzMLoiwJB16V8Vz/kHT7AK94ZpLPjedPr2O4U2DGQXu1TwP5nkfgQxTeP
K/XnDVHNsMKqTnc+YNX6mj/UyLnbs8eq/a9uHOBJR30e0OPAdlc2fTbBT2Cui29E
ctcNH4LrcH4au9vO+RpEUm1hqZy3mHrx1p8Six6+qJSERNYIWTID8gklyp8MSyG5
q7dk0WcyvytM1dmVf/q+KriljaZ8x2zLhQRz9vpgnfwJ6Qh3cLVoPItVdQ03WpKW
WAB1NCMMyNcszkLZ9OO3IRz8iyWV/KWGI07ngVuGa7dHuTje6ZjcObBCr2e4uuU+
CLENcretUAv0BtCsOBhQLXZ0qzqrgsVebTRQzm2zTM0yfBpcTtPd3MOMFeMQTHJJ
8QH6twAKeJfY1lUCTXJYy1ZcrKnrNehksST8tk98Km9t5M2X59QZk7mJzzsUbnWr
t+izid7xF7FAgDYj9XJgQHz04a4RjRSw5/6dgexAgvGoeOkG7uUhYd5DEYQCyQyR
Zy69pJN32L0nM2dC2e3NFU5BOBwocoKza3hdtSqqvIkj2kzyeU38uaJUco/Vk3OU
s+sQNZbk5C1pxkLLwzu815tKg77Om4Nwbi+bgDvI
-----END CERTIFICATE-----
-----BEGIN ENCRYPTED PRIVATE KEY-----
MIIFLTBXBgkqhkiG9w0BBQ0wSjApBgkqhkiG9w0BBQwwHAQIKq5EyxpPMjECAggA
MAwGCCqGSIb3DQIJBQAwHQYJYIZIAWUDBAEqBBAJ5rRZD/pRLBn/oEmayA8ZBIIE
0IkKXaWPM3Du1im+h7iC+JLKeXh6DT+OFOua9jf/8adva0hfHkF++LAAHLLe6J0v
QFm6/83guHGkw0LdoeeD/asjVZfzxlHZorjgcUGXEd1KQddsxAI/y8YfpOaujOmN
gMuiIBYvYqQvA545WQisKDRhPBeXl4X/1ILdNDU6ZizOXT67uzEl25zizQUELxop
ZVnx3a9S6iYL5Gb5FafXabxDBqC5D4YzB382wvj+Auuf9/KqcOj/SZwym/pLjWAL
65/HS3JX4CAa8/sVitm1zawh84J11q3bRsxZ0+YR/XB2FjBn5X1fozRGDywmSwl9
308dB5J6CV9NcDlWFU+Mel+ayonQZBnNSeGAFAA1vBl6O8H0T/cpYX5Xx77zQ6S/
++llR0ClGkEdWY/4sXzgeOA+osKqRzqFdcarI03wTzUA5ob7OJ3pOCXbkA2LhF07
ZbqrPxp+mKoD+sZtpVwPzBX1KptwzWrjtC0/1Glf2oBA8yOueEjx51C5oMUCBmtt
UQP3DijvHycMI0R7seYLlOVuPDYwG5JBd5TyhZnH4/NPfPT1vdFa38REXo9p/jYE
wvJC+UUY89k87eBAjv7V5YN/Ds0UHnAKtJ/mmCkXezdgBe1mZDLzfxGv01JeNo6M
ID251qJA2TTDY4KNUXgus/l6Wg94h9KHeYFa8Sp/fxwXXbaJsxDRHpUSybYEOHht
puY+76XKANK8OKzZwp/OG6W3Dqm8EGLsAu5ZD6Qz3P9dpkB40tYiInd4mO041RjA
mKHp4q/9tGZeOSmRkiNKZy1w+MovJ+/WzQL0ZJ4eGrpeK9ERsN8ynuCMCLVnzRW9
6bK3KCPfv2oRq7tW1sFapIA2x3cv0F1U48bTa7vZh+KzlL4V8t/FsVkJXs0Sc6ha
Nu2HyDku6qOOe03OmJs0ZjO2JB/kG2X4H5/yPeLjqiD2hS294dMqbgURz5bstW0b
Qo+5psIpGRh7rz5P1GfsvfEkYREp+GFIDtsrQ7PD7wOCqTLMvES+dEcHcoLz4ixs
5SwWIBHatZhc9DMXMVTpLkgUyV83mUjMd6/x4dN5+sy2b5AW5Zb7XvS+Dy/Bb4yG
Rlc6X+Gu9pse1/F9u4J33bFTQfSDr9nJT7JPnuwyiAg9cCZbsrKh8BfX/rACc1/b
dEP5k7BQDr3ULEoE/IzMTNhuVxvzy6kEVR+Q8H4H5pZxxqPl2iCpdVV9fJh/wNUh
TXlAiNnoBAKw9msInzPGdKWeKopQnqEsFR122TvvrK1nzu3+BBFR+oPcb/d3I+aG
dwy192MJuHGNrH7JI0M1XQPfrRhnf1h2FLtfMdGbWsyKBw/gGWtbP35M8VQ85zRy
c65WE6dC4ZE+lJCmimF7zAFTRvYm+PpkpIFhtsTzknGI21ES+KcdzviiKNt9fQJw
FHnyh1gebCsAcsbOCdn5dGbKYMLCOF8B/bYR4fG0q7BtcZsM8y42ZkBd9Mf87FEd
5hERO6FFqHlrepKW9EER3bG75VL0wvr4NU07knZX3my4mhgyv8a5Y/AZGVn0QILa
RI1M3x/+bT2TQTxsqcWGBmdp60NVgMpKsIuyNpuAl6nl1f/4U9xlgTt5dC9BKaC8
a9+DGukJ9BJ9SE+hpy2cxuHYHuOTWkpW9R4YVUooPedr
-----END ENCRYPTED PRIVATE KEY-----
martin-lindstrom commented 1 year ago

This is an error. The keyPassword is intended to be used when using a JKS or PKCS12 file. We don't support encrypted keys other than having them in JKS/PKCS12 packaging.

      credential:
        name: "test-cred"
        certificate: file:/opt/bankidp/config/bankid.cert
        private-key: file:/opt/bankidp/config/bankid.key
        keyPassword: 1234

See configuration of credentials at: https://github.com/swedenconnect/credentials-support.

theseal commented 1 year ago

Would it be possible to implement? The key pair we receive from BankID is cert and encrypted key so it would easy to use them out of the box.

martin-lindstrom commented 1 year ago

Everything is possible, but at this point you do have the possibility to use encrypted keys via JKS and/or PKCS#12. I'll make an issue in https://github.com/swedenconnect/credentials-support for this, but for the time being, add your cert and key to a P12.

martin-lindstrom commented 1 year ago

@theseal https://github.com/swedenconnect/credentials-support/issues/48