Skip to content

Fix/saml decryptor tool - #1432

Open
strongmindsmhs wants to merge 2 commits into
masterfrom
fix/tools-saml-decryptor
Open

Fix/saml decryptor tool#1432
strongmindsmhs wants to merge 2 commits into
masterfrom
fix/tools-saml-decryptor

Conversation

@strongmindsmhs

@strongmindsmhs strongmindsmhs commented Jun 4, 2026

Copy link
Copy Markdown

KITOS Pull request template

Description

This pull request significantly improves the usability, robustness, and clarity of the Tools.SAMLResponseDecryptor tool. The main changes include a complete overhaul of the command-line interface using Spectre.Console for interactive, user-friendly prompts and output, enhanced error handling, and better support for different SAML encryption schemes. The decryption logic is now more resilient to certificate/key issues and provides clear feedback to the user.

User Interface & Usability Improvements:

  • Replaced all Console.WriteLine prompts and outputs with rich, interactive Spectre.Console UI, including colored prompts, panels with instructions, markup, and tables for certificate/key info. This makes the tool much more user-friendly and visually clear.
  • Added step-by-step instructions for capturing and preparing the SAML response, displayed in a styled panel.
  • Added interactive prompts for certificate path, password, and SAML response file or manual input, with validation and clear error messages.
  • Added summary output for decrypted privileges and assertion, with clear section headers and formatting.

Robustness & Error Handling:

  • Improved error handling for file not found, decryption failures, and missing XML nodes, with user-friendly error messages explaining possible causes. [1] [2]
  • Added support for reading encrypted key and assertion values directly from files or manual input, with flexible input handling.

Decryption Logic Enhancements:

  • Enhanced the symmetric key decryption logic to try multiple key storage flags and RSA padding modes, making it more resilient to certificate and environment issues. Displays detailed certificate/key info on success.
  • Improved SAML assertion decryption to support both AES-256-GCM and AES-256-CBC, with auto-detection and clear error messages if the data does not match the expected format.
  • Extracts and displays the encryption algorithm from the SAML XML, summarizing key and assertion lengths and algorithm used.

Dependency Management:

  • Added Spectre.Console as a NuGet dependency for advanced console UI features.

Refactoring & Code Organization:

  • Refactored and modularized input handling, file resolution, and SAML XML parsing into helper methods for clarity and maintainability.

These changes make the tool much easier to use, more reliable, and better suited for real-world troubleshooting of SAML responses.

Checklist

The following procedure dictates the steps needed before a Pull request can be merged into master.

  • Implement:
    All requirements are implemented and unit tests are green

  • Merge master into branch / rebase with master:
    Make sure you are testing your changes and how they co-exist with the latest version of master

  • Green on integration:
    All integration tests are green on integration

  • Add a description
    Under "Description" above, explain what was changed in this branch, and WHY it was changed

  • Database compatibility:
    When database changes are included, both SQL Server and PostgreSQL versions have been updated, reviewed, and tested.

  • Warnings cleanup:
    Files with changes should be checked for warnings. Any warnings found should be fixed

Copilot AI review requested due to automatic review settings June 4, 2026 14:44
@strongmindsmhs strongmindsmhs changed the title Fixed saml decryptor tool Fix/saml decryptor tool Jun 4, 2026

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR updates the Tools.SAMLResponseDecryptor console utility to improve the interactive UX (using Spectre.Console) and make SAML decryption more resilient by trying additional certificate key-storage flags and supporting both AES-GCM and AES-CBC assertion decryption.

Changes:

  • Add Spectre.Console for structured, coloured CLI output and prompts.
  • Extend symmetric-key decryption to try multiple X509KeyStorageFlags + RSA padding combinations and print certificate/key details on success.
  • Add assertion decryption auto-detection (GCM-first fallback to CBC) and support extracting cipher values/algorithm directly from a captured SAML XML file.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 7 comments.

File Description
Tools.SAMLResponseDecryptor/Tools.SAMLResponseDecryptor.csproj Adds Spectre.Console NuGet dependency for improved CLI UX.
Tools.SAMLResponseDecryptor/SAMLDecryptor.cs Expands decryption strategy and adds AES-CBC support alongside AES-GCM.
Tools.SAMLResponseDecryptor/Program.cs Reworks user interaction, adds SAML XML parsing, and improves output formatting.

Comment on lines +40 to +42
var rsa = certificate.GetRSAPrivateKey();
if (rsa is null)
continue;
Comment on lines +62 to +65
$"[green]Symmetric key decrypted[/] [grey]({symmetricKey.Length * 8}-bit)[/]");

return symmetricKey;
}
Comment on lines 70 to 71
}
}
Comment on lines +91 to +93
var xmlDoc = new XmlDocument();
xmlDoc.LoadXml(decryptedAssertion);
var nsmgr = new XmlNamespaceManager(xmlDoc.NameTable);
Comment on lines +124 to +126
var xml = new XmlDocument();
xml.Load(samlFilePath);

Comment on lines +168 to +173
private static string AskValue(string markupLabel)
{
AnsiConsole.Markup(markupLabel + " ");
var input = Console.ReadLine()?.Trim() ?? string.Empty;
return ResolveFile(input);
}
Comment on lines +135 to +144
var cipherValues = xml.SelectNodes("//xenc:CipherData/xenc:CipherValue", ns);
if (cipherValues == null || cipherValues.Count < 2)
{
AnsiConsole.MarkupLine($"[red]Expected 2 CipherValue nodes, found {cipherValues?.Count ?? 0}.[/]");
AnsiConsole.MarkupLine("[grey]Ensure the file contains a full EncryptedAssertion with both EncryptedKey and EncryptedData.[/]");
return false;
}

encryptedKeyCipherValue = cipherValues[0]!.InnerText.Trim();
assertionCipherValue = cipherValues[1]!.InnerText.Trim();
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants