Fix/saml decryptor tool - #1432
Open
strongmindsmhs wants to merge 2 commits into
Open
Conversation
There was a problem hiding this comment.
Pull request overview
This PR updates the Tools.SAMLResponseDecryptor console utility to improve the interactive UX (using Spectre.Console) and make SAML decryption more resilient by trying additional certificate key-storage flags and supporting both AES-GCM and AES-CBC assertion decryption.
Changes:
- Add Spectre.Console for structured, coloured CLI output and prompts.
- Extend symmetric-key decryption to try multiple
X509KeyStorageFlags+ RSA padding combinations and print certificate/key details on success. - Add assertion decryption auto-detection (GCM-first fallback to CBC) and support extracting cipher values/algorithm directly from a captured SAML XML file.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 7 comments.
| File | Description |
|---|---|
| Tools.SAMLResponseDecryptor/Tools.SAMLResponseDecryptor.csproj | Adds Spectre.Console NuGet dependency for improved CLI UX. |
| Tools.SAMLResponseDecryptor/SAMLDecryptor.cs | Expands decryption strategy and adds AES-CBC support alongside AES-GCM. |
| Tools.SAMLResponseDecryptor/Program.cs | Reworks user interaction, adds SAML XML parsing, and improves output formatting. |
Comment on lines
+40
to
+42
| var rsa = certificate.GetRSAPrivateKey(); | ||
| if (rsa is null) | ||
| continue; |
Comment on lines
+62
to
+65
| $"[green]Symmetric key decrypted[/] [grey]({symmetricKey.Length * 8}-bit)[/]"); | ||
|
|
||
| return symmetricKey; | ||
| } |
Comment on lines
70
to
71
| } | ||
| } |
Comment on lines
+91
to
+93
| var xmlDoc = new XmlDocument(); | ||
| xmlDoc.LoadXml(decryptedAssertion); | ||
| var nsmgr = new XmlNamespaceManager(xmlDoc.NameTable); |
Comment on lines
+124
to
+126
| var xml = new XmlDocument(); | ||
| xml.Load(samlFilePath); | ||
|
|
Comment on lines
+168
to
+173
| private static string AskValue(string markupLabel) | ||
| { | ||
| AnsiConsole.Markup(markupLabel + " "); | ||
| var input = Console.ReadLine()?.Trim() ?? string.Empty; | ||
| return ResolveFile(input); | ||
| } |
Comment on lines
+135
to
+144
| var cipherValues = xml.SelectNodes("//xenc:CipherData/xenc:CipherValue", ns); | ||
| if (cipherValues == null || cipherValues.Count < 2) | ||
| { | ||
| AnsiConsole.MarkupLine($"[red]Expected 2 CipherValue nodes, found {cipherValues?.Count ?? 0}.[/]"); | ||
| AnsiConsole.MarkupLine("[grey]Ensure the file contains a full EncryptedAssertion with both EncryptedKey and EncryptedData.[/]"); | ||
| return false; | ||
| } | ||
|
|
||
| encryptedKeyCipherValue = cipherValues[0]!.InnerText.Trim(); | ||
| assertionCipherValue = cipherValues[1]!.InnerText.Trim(); |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
KITOS Pull request template
Description
This pull request significantly improves the usability, robustness, and clarity of the
Tools.SAMLResponseDecryptortool. The main changes include a complete overhaul of the command-line interface using Spectre.Console for interactive, user-friendly prompts and output, enhanced error handling, and better support for different SAML encryption schemes. The decryption logic is now more resilient to certificate/key issues and provides clear feedback to the user.User Interface & Usability Improvements:
Console.WriteLineprompts and outputs with rich, interactive Spectre.Console UI, including colored prompts, panels with instructions, markup, and tables for certificate/key info. This makes the tool much more user-friendly and visually clear.Robustness & Error Handling:
Decryption Logic Enhancements:
Dependency Management:
Refactoring & Code Organization:
These changes make the tool much easier to use, more reliable, and better suited for real-world troubleshooting of SAML responses.
Checklist
The following procedure dictates the steps needed before a Pull request can be merged into master.
Implement:
All requirements are implemented and unit tests are green
Merge master into branch / rebase with master:
Make sure you are testing your changes and how they co-exist with the latest version of master
Green on integration:
All integration tests are green on integration
Add a description
Under "Description" above, explain what was changed in this branch, and WHY it was changed
Database compatibility:
When database changes are included, both SQL Server and PostgreSQL versions have been updated, reviewed, and tested.
Warnings cleanup:
Files with changes should be checked for warnings. Any warnings found should be fixed