PH65833: NOSUCHALGORITMEXCEPTION UPON RECEIPT OF ASYMMETRIC KEY WRAP IN SAML SSO AND WS-SECURITY

APAR status

• Closed as program error.

Error description

• WS-Security and SAML Web SSO emits an error when a message
  is received that uses an asymmetric key wrap.  Example:
  
  Exception from decrypting the key:
  
  CWWSS5601E: The following exception occurred while decrypting
  the message: java.security.NoSuchAlgorithmException: No
  EncryptionEngine for http://www.w3.org/2001/04/xmlenc#rsa-1_5
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED:  All users of IBM WebSphere Application      *
  *                  Server                                      *
  ****************************************************************
  * PROBLEM DESCRIPTION: NoSuchAlgorithmException is emitted     *
  *                      when                                    *
  *                      SAML SSO or WS-Security receives a      *
  *                      message with asymmetric key wrap        *
  *                      algorithm                               *
  ****************************************************************
  * RECOMMENDATION:                                              *
  ****************************************************************
  WS-Security and SAML Web SSO emits an error when a message
  is received that uses an asymmetric key wrap algorithm.
  Example:
  Exception from decrypting the key:
  java.security.NoSuchAlgorithmException: No EncryptionEngine for
  http://www.w3.org/2001/04/xmlenc#rsa-1_5
  at
  com.ibm.ws.wssecurity.xml.xss4j.AlgorithmFactory.getEncryptionEn
  gine(AlgorithmFactory.java:1487)
  at
  com.ibm.ws.wssecurity.xml.xss4j.enc.DecryptionContext.getEncrypt
  ionEngine(DecryptionContext.java:700)
  at
  com.ibm.ws.wssecurity.xml.xss4j.enc.DecryptionContext.decrypt(De
  cryptionContext.java:617)
  at
  com.ibm.ws.wssecurity.saml.security.impl.EncryptedKeyConsume.dec
  ryptEncryptedKey(EncryptedKeyConsume.java:148)
  at
  com.ibm.ws.wssecurity.saml.security.impl.EncryptedDataConsumer.d
  ecryptKey(EncryptedDataConsumer.java:122)
  at
  com.ibm.ws.wssecurity.saml.security.impl.EncryptedDataConsumer.D
  ecryptEncryptedData(EncryptedDataConsumer.java:81)
  at
  com.ibm.ws.wssecurity.saml.protocol.saml20.impl.ResponseImpl.unM
  arshal(ResponseImpl.java:220)
  at
  com.ibm.ws.wssecurity.saml.protocol.saml20.impl.ResponseImpl.unM
  arshal(ResponseImpl.java:100)
  at
  com.ibm.ws.wssecurity.saml.binding.saml20.impl.SAMLResponseConte
  xtImpl.unMarshall(SAMLResponseContextImpl.java:87)
  at
  com.ibm.ws.wssecurity.saml.profile.saml20.sso.web.HTTPPOSTReques
  tConsumer.consumeSAMLResponseWithoutValidation(HTTPPOSTRequestCo
  nsumer.java:143)
  at
  com.ibm.ws.wssecurity.saml.profile.saml20.sso.web.HTTPPOSTReques
  tConsumer.consumeSAMLResponse(HTTPPOSTRequestConsumer.java:114)
  at
  com.ibm.ws.security.web.saml.SAMLResponseProcessor.consumeSAMLRe
  sponse(SAMLResponseProcessor.java:100)
  at
  com.ibm.ws.security.web.saml.SAMLResponseProcessor.processSAMLRe
  sponse(SAMLResponseProcessor.java:83)
  at
  com.ibm.ws.security.web.saml.SAMLResponseProcessor.process(SAMLR
  esponseProcessor.java:51)
  at
  com.ibm.ws.security.web.saml.ACSTrustAssociationInterceptor.proc
  essSAMLResponseContext(ACSTrustAssociationInterceptor.java:1065)
  at
  com.ibm.ws.security.web.saml.ACSTrustAssociationInterceptor.invo
  keTAIbeforeSSO(ACSTrustAssociationInterceptor.java:648)
  at
  com.ibm.ws.security.web.saml.ACSTrustAssociationInterceptor.nego
  tiateValidateandEstablishTrust(ACSTrustAssociationInterceptor.ja
  va:442)
  at
  com.ibm.ws.security.web.TAIWrapper.negotiateAndValidateEstablish
  edTrust(TAIWrapper.java:103)
  at
  com.ibm.ws.security.web.WebAuthenticator.handleTrustAssociation(
  WebAuthenticator.java:449)
  at
  com.ibm.ws.security.web.WebAuthenticator.authenticate(WebAuthent
  icator.java:3201)
  at
  com.ibm.ws.security.web.WebCollaborator.SetAuthenticatedSubjectI
  fNeeded(WebCollaborator.java:3552)
  at
  com.ibm.ws.security.web.WebCollaborator.authorize(WebCollaborato
  r.java:862)
  at
  com.ibm.ws.security.web.EJSWebCollaborator.preInvoke(EJSWebColla
  borator.java:450)
  at
  com.ibm.ws.webcontainer.collaborator.WebAppSecurityCollaboratorI
  mpl.preInvoke(WebAppSecurityCollaboratorImpl.java:230)
  at
  com.ibm.wsspi.webcontainer.collaborator.CollaboratorHelper.preIn
  vokeCollaborators(CollaboratorHelper.java:436)
  at
  com.ibm.ws.webcontainer.filter.WebAppFilterManager.invokeFilters
  (WebAppFilterManager.java:1101)
  at
  com.ibm.ws.webcontainer.webapp.WebApp.handleRequest(WebApp.java:
  4238)
  at
  com.ibm.ws.webcontainer.webapp.WebAppImpl.handleRequest(WebAppIm
  pl.java:2210)
  at
  com.ibm.ws.webcontainer.webapp.WebGroup.handleRequest(WebGroup.j
  ava:304)
  at
  com.ibm.ws.webcontainer.WebContainer.handleRequest(WebContainer.
  java:1033)
  at
  com.ibm.ws.webcontainer.WSWebContainer.handleRequest(WSWebContai
  ner.java:1817)
  at
  com.ibm.ws.webcontainer.channel.WCChannelLink.ready(WCChannelLin
  k.java:382)
  at
  com.ibm.ws.http.channel.inbound.impl.HttpInboundLink.handleDiscr
  imination(HttpInboundLink.java:465)
  at
  com.ibm.ws.http.channel.inbound.impl.HttpInboundLink.handleNewRe
  quest(HttpInboundLink.java:532)
  at
  com.ibm.ws.http.channel.inbound.impl.HttpInboundLink.processRequ
  est(HttpInboundLink.java:318)
  at
  com.ibm.ws.http.channel.inbound.impl.HttpICLReadCallback.complet
  e(HttpICLReadCallback.java:88)
  at
  com.ibm.ws.ssl.channel.impl.SSLReadServiceContext$SSLReadComplet
  edCallback.complete(SSLReadServiceContext.java:1833)
  at
  com.ibm.ws.tcp.channel.impl.AioReadCompletionListener.futureComp
  leted(AioReadCompletionListener.java:175)
  at
  com.ibm.io.async.AbstractAsyncFuture.invokeCallback(AbstractAsyn
  cFuture.java:217)
  at
  com.ibm.io.async.AsyncChannelFuture.fireCompletionActions(AsyncC
  hannelFuture.java:161)
  at
  com.ibm.io.async.AsyncFuture.completed(AsyncFuture.java:138)
  at
  com.ibm.io.async.ResultHandler.complete(ResultHandler.java:204)
  at
  com.ibm.io.async.ResultHandler.runEventProcessingLoop(ResultHand
  ler.java:775)
  at
  com.ibm.io.async.ResultHandler$2.run(ResultHandler.java:905)
  at
  com.ibm.ws.util.ThreadPool$Worker.run(ThreadPool.java:1909)
  [10/8/24 16:41:15:725 CDT] 000001d9 FfdcProvider  W
  com.ibm.ws.ffdc.impl.FfdcProvider logIncident FFDC1003I: FFDC
  Incident emitted on
  /u02/logs/WebSphere/logs/ffdc/PPD_N1_SSO_UI1_8387df0_24.10.08_16
  .41.15.7251650254488761161293.txt null.decryptEncryptedKey 793
  [10/8/24 16:41:15:725 CDT] 000001d9 EncryptedKeyC E
  CWWSS5601E: The following exception occurred while decrypting
  the message: java.security.NoSuchAlgorithmException: No
  EncryptionEngine for http://www.w3.org/2001/04/xmlenc#rsa-1_5
  

Problem conclusion

• Update the code to use crypto provider that supports
  rsa(both rsa-oaep and rsa-1_5)key wrap algorithms with FIPS140-2
  
  The fix for this APAR is targeted for inclusion in fix pack
  9.0.5.24 and 8.5.5.28.
  For more information, see 'Recommended
  Updates for WebSphere Application Server':
  https://www.ibm.com/support/pages/node/715553
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  WEBS APP SERV N

• Fixed component ID

  5724H8800

Applicable component levels