Pass full EncryptedAssertion node to decrypt

[sebreh]

When implementing SAML support with Okta as the IdP, I noticed they send encrypted assertions with the EncryptedKey node as a sibling to the EncryptedData node, not as a child node as expected by this library. Because only the EncryptedData node is passed to xmlenc.decrypt, it is unable to find the key referenced by URI from RetrievalMethod. Hence, it cannot determine the algorithm to use for decrypting the assertion.

example response:

<?xml version="1.0" encoding="UTF-8"?>
<saml2p:Response xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol" ID="_2" Version="2.0" InResponseTo="_1" Destination="https://sp.example.com/assert">
  <saml2p:Status>
    <saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/>
  </saml2p:Status>
  <saml2:EncryptedAssertion xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">
    <xenc:EncryptedData xmlns:xenc="http://www.w3.org/2001/04/xmlenc#" Type="http://www.w3.org/2001/04/xmlenc#Element">
      <xenc:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#aes256-cbc" xmlns:xenc="http://www.w3.org/2001/04/xmlenc#"/>
      <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
        <ds:RetrievalMethod Type="http://www.w3.org/2001/04/xmlenc#EncryptedKey" URI="#_ad3ba8b1e8dbca2bb43001b189b0bc7c"/>
      </ds:KeyInfo>
      ...
    </xenc:EncryptedData>
    <xenc:EncryptedKey xmlns:xenc="http://www.w3.org/2001/04/xmlenc#" Id="_ad3ba8b1e8dbca2bb43001b189b0bc7c">
      <xenc:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-1_5" xmlns:xenc="http://www.w3.org/2001/04/xmlenc#"/>
      ...
    </xenc:EncryptedKey>
  </saml2:EncryptedAssertion>
</saml2p:Response>

This fixes the issue by passing the full EncryptedAssertion node to xmlenc.decrypt, and upgrading the xml-encryption to include changes for improved algorithm detection.

[jefff]

Thanks for the PR! This lgtm.

[jefff]

Published as 1.10.0.

[sebreh]

Awesome, thanks for the quick merge/publish 👍