Symfony IDP - openssl signing error EVP_DecryptFinal_ex:bad decrypt - SHA256

Question

i've got a problem with the certificates i think. I've set up my idp and tested it with https://samltest.id/start-idp-test/. I'm using Symfony 3.4 with this bundle to create the idp.

Now i want to add talentlms . I've created a self signed certificate on the server with the following command:

openssl req -new -x509 -sha256 -newkey rsa:4096 -nodes -keyout key.pem -out cert.pem -days 365

I've placed the files under app/Resources/saml_keys/ and added this path in the config:

public_key: '%kernel.root_dir%/Resources/saml_keys/cert.pem'
private_key: '%kernel.root_dir%/Resources/saml_keys/key.pem'

I've added the public certificate to my talentlms profile. If i check from talentlms i will be redirected to my login page and can login. After the login i'm getting this error before redirect:

app.NOTICE: Authentication succeed [] []
security.INFO: User has been authenticated successfully. {"username":"[email protected]"} []
app.NOTICE: Continue SSO process [] []

request.CRITICAL: Uncaught PHP Exception Exception: "Failure Signing Data: error:06065064:digital envelope routines:EVP_DecryptFinal_ex:bad decrypt - SHA256" at /var/www/vhosts/xxxxxx.de/idp.xxxxx.de/vendor/robrichards/xmlseclibs/src/XMLSecurityKey.php line 464 {"exception":"[object] (Exception(code: 0): Failure Signing Data: error:06065064:digital envelope routines:EVP_DecryptFinal_ex:bad decrypt - SHA256 at /var/www/vhosts/xxxx.de/idp.xxxxx.de/vendor/robrichards/xmlseclibs/src/XMLSecurityKey.php:464)"}

So where is the problem? Is the creation of the certificate wrong?

Here is my SP config like explained in the bundle:

$this->spMap["xxxxxx.talentlms.com"] = new ServiceProvider(
            [
                /**
                 * Returns the contents of an X509 pem certificate, without the '-----BEGIN CERTIFICATE-----' and
                 * '-----END CERTIFICATE-----'.
                 *
                 * @return null|string
                 */
                'certificateData' => '',

                /**
                 * Returns the full path to the (local) file that contains the X509 pem certificate.
                 *
                 * @return null|string
                 */
                "certificateFile" => $this->rootDir . '/Resources/saml_keys/cert.pem',

                /**
                 * @return null|string
                 */
//                "entityId" => "https://xxxxx.talentlms.com/simplesaml/module.php/saml/sp/metadata.php/xxxxx.talentlms.com",
                "entityId" => "xxxxx.talentlms.com",

                /**
                 * @return null|bool
                 */
                "assertionEncryptionEnabled" => true,

                "assertionConsumerUrl" => "https://xxxxx.talentlms.com/simplesaml/module.php/saml/sp/saml2-acs.php/xxxxxx.talentlms.com",
                "assertionConsumerBinding" => \SAML2_Const::BINDING_HTTP_POST,
                "singleLogoutUrl" => "https://xxxxx.talentlms.com/simplesaml/module.php/saml/sp/saml2-logout.php/xxxxxx.talentlms.com",
                "singleLogoutBinding" => \SAML2_Const::BINDING_HTTP_REDIRECT,
                "nameIdFormat" => \SAML2_Const::NAMEID_PERSISTENT,
                "nameIdValue" => function (UserInterface $user) {
                    /** @var Member $user */
                    return $user->getEmail();
                },
                "NameQualifier" => 'xxxxx.talentlms.com',
                "wantSignedAuthnRequest" => false,
                "wantSignedAuthnResponse" => true,
                "wantSignedAssertions" => true,
                "wantSignedLogoutRequest" => false,
                "wantSignedLogoutResponse" => false,
                "attributes" => [
                    'targetedID' => function (UserInterface $user) {
                        /** @var Member $user */
                        return $user->getEmail();
                    },
                    'email' => function (UserInterface $user) {
                        /** @var Member $user */
                        return $user->getEmail();
                    },
                    'firstname' => function (UserInterface $user) {
                        /** @var Member $user */
                        return $user->getFirstName();
                    },
                    'lastname' => function (UserInterface $user) {
                        /** @var Member $user */
                        return $user->getLastName();
                    },
                ],
                "assertionNotBeforeInterval" => new \DateInterval('PT0S'),
                "assertionNotOnOrAfterInterval" => new \DateInterval('PT5M'),
                "assertionSessionNotOnOrAfterInterval" => new \DateInterval('P1D'),
            ]
        );

I've expected to be redirected back to talentlms.

Tanktiger Tanktiger · Accepted Answer · 2019-05-13T13:02:02

I've found the problem. On my server i can't use the -sha256 flag. My new openssl command is openssl req -x509 -nodes -newkey rsa:4096 -keyout key_4096.pem -out cert_4096.pem -days 3655

On talentlms i needed to put the cert file in the config. The generated hash was also wrong, because talentlms does not save the cert correctly. I've added a generated sha1 hash on my own and it worked.

Symfony IDP - openssl signing error EVP_DecryptFinal_ex:bad decrypt - SHA256

1 Answers