Missing encrypted data in <saml:EncryptedAssertion>

[pad...@iandcdigital.com]

I recently moved a site to a new ssl server from a http server and I started getting errors when getting a response from the idp I am using.

My setup is not the standard setup in that I have placed the simplesamlphp setup outside /var/simplesamlphp/

Backtrace:
0 /home/saml/public_html/simplesp/module.php:180 (N/A)
Caused by: Exception: Missing encrypted data in <saml:EncryptedAssertion>.
Backtrace:
5 /home/saml/simplesamlphpsp/vendor/simplesamlphp/saml2/src/SAML2/EncryptedAssertion.php:31 (SAML2_EncryptedAssertion::__construct)
4 /home/saml/simplesamlphpsp/vendor/simplesamlphp/saml2/src/SAML2/Response.php:38 (SAML2_Response::__construct)
3 /home/saml/simplesamlphpsp/vendor/simplesamlphp/saml2/src/SAML2/Message.php:547 (SAML2_Message::fromXML)
2 /home/saml/simplesamlphpsp/vendor/simplesamlphp/saml2/src/SAML2/HTTPPost.php:74 (SAML2_HTTPPost::receive)
1 /home/saml/simplesamlphpsp/modules/saml/www/sp/saml2-acs.php:31 (require)
0 /home/saml/public_html/simplesp/module.php:137 (N/A)

I have logged the response from the server and it includes the encrypted data

I have done a var_dump of the xml before line SAML2/EncryptedAssertion.php:31 (SAML2_EncryptedAssertion::__construct) and the xenc:EncryptedData tag is missing

$data = SAML2_Utils::xpQuery($xml, './xenc:EncryptedData');

I was wondering has anyone encountered this problem

[Peter Schober]

* pad...@iandcdigital.com <pad...@iandcdigital.com> [2017-04-12 16:41]:

> I recently moved a site to a new ssl server from a http server and I
> started getting errors when getting a response from the idp I am using.

You're saying you've changed your server setup, gave updated SAML 2.0
Metadata to the IDP and now the IDP is sending different data?

> My setup is not the standard setup in that I have placed the
> simplesamlphp setup outside /var/simplesamlphp/

You can put SSP anywhere, it doesn't matter.

> Backtrace:
> 0 /home/saml/public_html/simplesp/module.php:180 (N/A)

May not have anything to do with your issues and I'm sure how you
deployed the software, but what parts of SSP did you copy to your
public_html folder? I'm guessing you've deployed the SSP SAML2 library
(possibly via composer) and not the full SSP application?
https://github.com/simplesamlphp/saml2 vs.
https://github.com/simplesamlphp/simplesamlphp

> Caused by: Exception: Missing encrypted data in <saml:EncryptedAssertion>.

Well, if it's missing then the IDP has not put it into the response,
no? So likely the IDP changed something. (I doubt the IDP stopped
encrypting the SAML Assertion only because your site now has
TLS-protected endpoints, but then only you and/or the IDP would know
about that.)

> I have logged the response from the server and it includes the encrypted
> data
>
> I have done a var_dump of the xml before line
> SAML2/EncryptedAssertion.php:31 (SAML2_EncryptedAssertion::__construct) and
> the xenc:EncryptedData tag is missing

So which one is it? Is it there ("the encrypted data") or is it
missing? Hard to believe any of this has to do with you changing to
TLS, though.
-peter

[pad...@iandcdigital.com]

Thanks for the response Peter

I deployed the contents of the www that came with simplesamlphp folder to the public_html folder and it contains folders

admin
resources
saml2
shib13

files
_include.php
authmemcookie.php
errorreport.php
index.php
logout.php
module.php

So looking at the log file and the xml response from the idp there is

<saml2:EncryptedAssertion xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">
   <xenc:EncryptedData...
   <xenc:EncryptionMethod xmlns:xenc="http://www.w3.org/2001/04/xmlenc#" Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p">...

I updated my metadata and updated via the idp registry repository

The assertion consumer service is set to use http://mysite.org/simplesp/module.php/saml/sp/saml2-acs.php/default-sp and before the move to the new server we changed the domain to http://www.mysite.org/simplesp/module.php/saml/sp/saml2-acs.php/default-sp

This was the only change that was made after the move

I am just trying to identify where the problem might be and maybe the only way to solve it is to setup a new service provider on the idp

Thanks

[Jaime Perez Crespo]

Hi,

On 12 Apr 2017, at 18:49 PM, pad...@iandcdigital.com wrote:
> Thanks for the response Peter
>
> I deployed the contents of the www that came with simplesamlphp folder to the public_html folder and it contains folders

I understand you deployed the entire SimpleSAMLphp and not just the www folder, right? Because the rest of the files are there for a reason…55

> admin
> resources
> saml2
> shib13
>
> files
> _include.php
> authmemcookie.php
> errorreport.php
> index.php
> logout.php
> module.php
>
> So looking at the log file and the xml response from the idp there is
>
> <saml2:EncryptedAssertion xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">
> <xenc:EncryptedData...

> <xenc:EncryptionMethod xmlns:xenc="http://www.w3.org/2001/04/xmlenc#" Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p">…

That sounds a bit weird. The xenc namespace should be defined in xenc:EncryptedData if that one happens first, but it’s impossible to say without seeing the actual response.

Why don’t you install the SAML tracer firefox plugin, put it to work, and past here the entire response? Then we can clearly see if there’s anything wrong with it and stop speculating...

--
Jaime Pérez
UNINETT / Feide

jaime...@uninett.no
jaime...@protonmail.com
9A08 EA20 E062 70B4 616B 43E3 562A FE3A 6293 62C2

"Two roads diverged in a wood, and I, I took the one less traveled by, and that has made all the difference."
- Robert Frost

[pad...@iandcdigital.com]

Here is a dump of a saml response I am receiving

<saml2p:Response xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol"
                 Destination="http://staff.socs.nuigalway.ie/simplesp/module.php/saml/sp/saml2-acs.php/default-sp"
                 ID="_b2463045433d46f322ba072585484bb9"
                 InResponseTo="_27dce219f68c3e3db97d6dd1ea5423927b87342ace"
                 IssueInstant="2017-04-13T16:11:41.929Z"
                 Version="2.0"
                 >
    <saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"
                  Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity"
                  >https://idp.nuigalway.ie/shibboleth</saml2:Issuer>
    <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
        <ds:SignedInfo>
            <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
            <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" />
            <ds:Reference URI="#_b2463045433d46f322ba072585484bb9">
                <ds:Transforms>
                    <ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" />
                    <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
                </ds:Transforms>
                <ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" />
                <ds:DigestValue>18PxAlFP1l2a3M4HrYiR9YXFPXc=</ds:DigestValue>
            </ds:Reference>
        </ds:SignedInfo>
        <ds:SignatureValue>Eo9EJPmN+Z/B/1K4jGMM/2xs+Iauo5/TAcFBxXGRVpsTitbkAKFb2U9nYxIQA01fZNfWRt7hDbwSJqfR+qzJoiYB9aBOZLLlS4h3Mnp8VqcHiXFmPCXKXaIgJ1yxvQXRt90kyfTztFXAqaBwOGr/+xmzqa77pyJGaGZLM4gBxl37W7v7zU1bWG13rxpZTuEDcE0BstqUbH0M+dePo/YBtAdoLL4CmX2nkECMxcoUWPDsvOIt5ZeBDqjlTLQfm60hgXbMfTTOwif3awb/C0yUsyL+Ue7i+xrS4orj2cAKdy2LRtb2xYf35nAUwea/K7mx9+bLNjqpP4ba154faAZ9gg==</ds:SignatureValue>
        <ds:KeyInfo>
            <ds:X509Data>
                <ds:X509Certificate>MIIDKzCCAhOgAwIBAgIUaZj83WML6Ro0NOTyru/oCY9DaWcwDQYJKoZIhvcNAQEFBQAwGzEZMBcG
A1UEAxMQaWRwLm51aWdhbHdheS5pZTAeFw0xMDA4MzAxNDUyMjJaFw0zMDA4MzAxNDUyMjJaMBsx
GTAXBgNVBAMTEGlkcC5udWlnYWx3YXkuaWUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB
AQCVTQr39i7dOPz//U7kaSk61ADv8zczZ4deMcSfUXGtBXwm1G913PqpjDkphmI5A5ehg7tOLjc1
I/QXQI/MOi5EW5p89mlrjtjuikIEZ1QJFnM0sGP2wNXUmFnfD3SX78lZbd6pqTDh/EyyO21q/6/7
nIH38Ds/R51LWZ4SHLXiVUj+xoLh9PaIWb1j2X9AS6t7FoUTfkQDTrNc78HNpTRy/RPNRKfzVUWs
qmCbgCrVgz2k8ie5j9YDJ0IpFfGbdBOGUqaZuu53gyMzRTJ2KCmKIirHhMtk4fkx3lh9qaWMvpep
9Ys9fcvv7h9ODKBDycRxoVJhfvKpRct3OmU38DFnAgMBAAGjZzBlMEQGA1UdEQQ9MDuCEGlkcC5u
dWlnYWx3YXkuaWWGJ2h0dHBzOi8vaWRwLm51aWdhbHdheS5pZS9pZHAvc2hpYmJvbGV0aDAdBgNV
HQ4EFgQUoSgXUY0R/R/LWeanf9/oteOvIL4wDQYJKoZIhvcNAQEFBQADggEBACenzaISa4sjW40c
KZAdYMYpAj/83wlM5r5jNvK4XML3DuQdgvVfgDhU7DLbeQTPvcySE2Mfn87PHT7wdCXZoOu0COH3
D94Tc3/G3bu1uLg/VV6TGsNDHL7WqoUNnmHniZVOi6khONlufFLj4TbR3a8uxS/b1aO8RapnJUXY
0Vhem17h/8bHmpw1RurScX0lXL1JA0PPEaF9nTCW5KfIOBVEYnwBW7s4pF85szVB4cSNiz6pRVen
Aw6s6bJ5AVYSXYGmkDRpm5OCzdVNzOzjlmrFkun2ue2G3ICbbxLefYZY3Y2Z8ASfN3caaadnEwn9
ya6o47MywXTzmzIIbq1mvWc=</ds:X509Certificate>
            </ds:X509Data>
        </ds:KeyInfo>
    </ds:Signature>
    <saml2p:Status>
        <saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" />
    </saml2p:Status>
    <saml2:EncryptedAssertion xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">
        <xenc:EncryptedData xmlns:xenc="http://www.w3.org/2001/04/xmlenc#"
                            Id="_afa3115ef8c87aeb62d62339a3322b4d"
                            Type="http://www.w3.org/2001/04/xmlenc#Element"
                            >
            <xenc:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#aes128-cbc"
                                   xmlns:xenc="http://www.w3.org/2001/04/xmlenc#"
                                   />
            <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
                <xenc:EncryptedKey Id="_6f9a23c1ad91d76d05dacf8806461aee"
                                   xmlns:xenc="http://www.w3.org/2001/04/xmlenc#"
                                   >
                    <xenc:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p"
                                           xmlns:xenc="http://www.w3.org/2001/04/xmlenc#"
                                           >
                        <ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"
                                         xmlns:ds="http://www.w3.org/2000/09/xmldsig#"
                                         />
                    </xenc:EncryptionMethod>
                    <ds:KeyInfo>
                        <ds:X509Data>
                            <ds:X509Certificate>MIIEjzCCA3egAwIBAgIJAKyAYchtkAU1MA0GCSqGSIb3DQEBBQUAMIGLMQswCQYDVQQGEwJJUjER
MA8GA1UECBMIQ29ubmFjaHQxDzANBgNVBAcTBkdhbHdheTEYMBYGA1UEChMPSSBhbmQgQyBEaWdp
dGFsMRgwFgYDVQQDEw9JIGFuZCBDIERpZ2l0YWwxJDAiBgkqhkiG9w0BCQEWFWluZm9AaWFuZGNk
aWdpdGFsLmNvbTAeFw0xNzAxMTgxNDU1NTVaFw0yNzAxMTgxNDU1NTVaMIGLMQswCQYDVQQGEwJJ
UjERMA8GA1UECBMIQ29ubmFjaHQxDzANBgNVBAcTBkdhbHdheTEYMBYGA1UEChMPSSBhbmQgQyBE
aWdpdGFsMRgwFgYDVQQDEw9JIGFuZCBDIERpZ2l0YWwxJDAiBgkqhkiG9w0BCQEWFWluZm9AaWFu
ZGNkaWdpdGFsLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANboh/xu+4n/mQN/
GP2vdIW6ngfuD9Z7Z2bRm392PCQkop/BRp4Szfu0DhC1/xfd6WB6rlw9KIdzNCyILMQuwLhLETn8
Z7I/6H9TJ0e/EnG00eW+U179I/jd2TBXERxWxVAiC9A1YHdw+qE6kDIaVFeD5tIHx//uMxXEc1O/
rbEeSeHOo6mGYADqPIwbspg5xNEngiKYXisQtMmCQAy9QRVERhQR/l3o0c0cvhwk9qe9auGtqj7y
SkOM/dK/eZq6/DfH/VcerB3lpR0tXktVkUVZ+IQdVNFqsTWFCTomrTGwZTeCVZGv649zlev2+deR
qkagAylD5ishm2GU4oZJ2bMCAwEAAaOB8zCB8DAdBgNVHQ4EFgQUGbZDR9Hc699KO1kNvAaROswy
t6EwgcAGA1UdIwSBuDCBtYAUGbZDR9Hc699KO1kNvAaROswyt6GhgZGkgY4wgYsxCzAJBgNVBAYT
AklSMREwDwYDVQQIEwhDb25uYWNodDEPMA0GA1UEBxMGR2Fsd2F5MRgwFgYDVQQKEw9JIGFuZCBD
IERpZ2l0YWwxGDAWBgNVBAMTD0kgYW5kIEMgRGlnaXRhbDEkMCIGCSqGSIb3DQEJARYVaW5mb0Bp
YW5kY2RpZ2l0YWwuY29tggkArIBhyG2QBTUwDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQUFAAOC
AQEAw8TbSUVIQ95kmW/1Jjh3aYa8+W29wzqJJxts/a9/pdaN0pRLZNGyrCRoinXg6ja+PioatWzz
/vdCb4heeMLXu03DzBSIeyQ4mIzJ+SJGmRohjiKepBDVKgJEKf9A5hCO2ALyg9SxjAx5PC5VYrrH
JAz8yQg83eF2L92lekfTMnWB+8Io04hRd5zMSzDkrtRYI+R5XPge+8IbHxMFViSPjuTTNqGIYoKB
rhEnrFjpgH/6Ah3/aFTUfMk+JUiBnh63SuE9v5OcnCDF1WHOABXBp12B0Qt+IaGJW/uMlKUy06Y3
MG2iAdQdmyvL33FJOl2zEkxe3B/5KwLqsJz+mnGFAw==</ds:X509Certificate>
                        </ds:X509Data>
                    </ds:KeyInfo>
                    <xenc:CipherData xmlns:xenc="http://www.w3.org/2001/04/xmlenc#">
                        <xenc:CipherValue>RfnR45COFYJ1br3KQhz5MaZaoyPx2eKb8tlNn8hOJ2rH1AsexT3FtlWUgClyW+hSY2/ut2Y4vNN04MCjQE90bVyZhPItBvYawhxAt9fGU00SmTToPXDxAwRanAhGaFOmTVV9iMOCqq9aQRjLsr7xwHmcwXRihyDRgnmj3qTYhJAacSIuJYpUQeyc47gLIsOexWrOXxA522O/ZhjYRxjegQOXL1vi5L57RzpVSP0ldvovSrPlEKvD1HdbucgRPM4wZSGYasMv610EA56CH3cfwVPbKYrGgMtCmvlfr/BuaVlGy4jIOfRq4tK/eWM5t1zhbjBa7XXwgkZphpM6fF44PQ==</xenc:CipherValue>
                    </xenc:CipherData>
                </xenc:EncryptedKey>
            </ds:KeyInfo>
            <xenc:CipherData xmlns:xenc="http://www.w3.org/2001/04/xmlenc#">
                <xenc:CipherValue>GvaKfSbSC4Wz/LxNtBQXidRNmtEjwM6durFXf9QzUzrOzlNFNL2z2ratCpMVmjyaHhwwSEaSDUOcq8ktFKq2PhA0pTVQYyS3NlS/PS5jGd1s3RvSSQgr4VTsCpKPFUZpmVOAtU6b6IrBlk3Lpxs97yzHO6Sav3GeLnDzFmNPY6DQKX8RWd7GsXOH2LKd3HozsQi7+1GJg06XPxKPRteS401J5sCed9mtme9z4SM5XIyIeHtlJlv13aYUry4Zd1/fiBbJjrchGFu9a20pHfDXDVVMCHgGKsZ07Mtj3DJnb5zVyY9KKqybZdgOG6GuwNfx0naMY3zg4rRKkJHqZGhjabT6RIcozZkgF26qQSkU55p2c5jPhQ4nxKBtn0WTh/+TRCC0Pq6g2prWWiT+bdq8rFosMNZqqTgxYcEivT0ux9ti3LSjNroe10rANAjWB9lvQAFxCyP99Jh28hTZAwsTzVicWUc9LvwVSov0uHT3ItP52Q2v9qk0S/+CELvg6v1MEbKbRBL8wWZQbzOhUQgc1nvybWxezjHg8NYlNo9E2hR+Yg7R8jUs6ixMWwxgqRbMxRrMmX2zRvJbDODDYCedjLxylS5VJFVP9fMVwFsQYhfSDDrg+idNO0LwTTbnKQWq+Sn3NAWbO3z9JqxDKi7f+EykB8XXb0lS2h25zAlbL7KlEAUzf6USQzvSf1MrEnaIRp9Fd7l9ShlHT7HZgrf/ipt+SEf2V1Fs0H+ZNvJJ9wW0S1OML0b6EyyS01lqbUK/rYVmy4lPha91Hw/aqoznCsBqjl9qp8tdnkan9m7JGXjZSyFgFnKjYVzpnKkLzzrSTyg0BHic0ilr47W8gmTmyBxoik3NAkyr9WUhTcLkwmJlato9QqJ0DtE4z6crfe3JKBIvIuVWqN9NZRLNZ1bhhmiK2P8l1y4FThJ1Iog/l7yc+oaGHyv5LXrD8335kezvrpOfxeNGVzwDKlUTQ4YNEFopNStXxwaS6AA73hi1XVc1Dn+qnXX3tdIrH0Pw41R2yJzvaiQQvEYLxCbCnIbd65tpVXaS0J0B8wD/Qa9ofI+DSlKDVJ+igEDw5oxR+GYhuFQMPTKrAjy0TN3bf/dAiB01XgE/v9ksAbepUaKkB9IintXxN1Z47yXR31OJOrllwO52TvtCX4IsHOnok5FlJHXWbSfZsXSg/Za43BSHLXhArbA+/YwYBvt0OV1C5xnkjauejszJvhgrNtu/YTRMQWo96id9UX0MWYELTg05geligg3AtnOdvJXpGrIVgGPXEf3VHeozBQLx3MJTt/6ngdP+5x3fmD3DxagZVYu0d4rpXyUo7HBafq/RQfXZwlANcjBF1xUG4ihLZdWVY7/r+xsFLIT/CPZANxtUWcylISjKi9URudFxjh4dBUJT/EIB7vfitm76pcMsmdfURS5ghPI/iPaHM/qLtrirh9GmR9VbhpTfic5C8mYICsArofqKG4B1kddxWTq/PhY7KUBMC1s2Vm55Q7XrPf5f8Z/4K0uz1//gQnS7NdyZd3BBQ4FBzHB29TWu/tkoKPA3ue0i68GlBrydOfFSdhdGo+BCorydI7wnuuNtRNd01VK5H1M64UXG7hLEfCiGuExBCKHgCKEGhbyEaEBw6xqws1JGhCESSSS3dluD2hXpu5A8q0xnG0YKrT1aDgNZvfxWOiGhBA8eiwmLZcaziV9PEFYprFRSfSoOhmrS8YYE4NcdC8/LoQw9YiSoRpqzptBry0dY1jtINGZK2ycQCF6OgZbOeLH/zGPElG0w4IHmqwPBqqFbFKXU4BeJ0TQKMq415+K4RlveKqhzzey7HnCFIXRCrYNtw8ZaYnVPxwY2VXXVTKKrdpXPjXIrlS+US7rS9lcsbSTtZRrYWRSgVPGvX1OCypr5y6Fv5JQA9qF5A0vE55PR1gSyA2hRZ9tbZmaWq4pVZ6xUm/QsyFRbcdenyzuvnBddRHHvXhGD3Xpai7J6W0HpKzS1vtmX8Yxx8JlOEbuPAs0L5KfqKj3/8nSG4HhAL7f4bvfg9AAuqJMW2Fcq8jVguJhSeiHC1ZrchwwonGZM5fUBgyEwJWDsboXIzHyHXb8vqyH9idMNrbFD4fUrFpiqQekwfZzXifG3+jdjTFNM0kZzTPNa6fv1xJY65Ox19ltVrug3kAooawwM05+PR5Dj+jHo8MAPzlKC694lSluz+qbOjtKj93uN/GoeosU3TsQgt9FobGvfM76xkAP3iCU3m7YVt70jGThJKQSBCsTlKOXxEy/rVIBsZK8gePQIH5Ef4u9IBvlcac/CvY7+zEncxhGD1DJp+h/toVR+nxtCexbUolvzwIeRcrrdE4H0ZCmvEvvesWBbmvQ+/ZepvvbF0TzvxBvuL+qkZolMFZon3kPqzm6lcES+ovMKiKFm1YeNDpTJvxYpDmbejMSXx6SlHCxuohsGXik41jzKwH2k+ZhXTItNuaDXdF814TbzSiMzvIYFsIYjCIN0mZOtA/31yHCv84ZbUKZtC7bBCfFPMy1Nh7dI/b3EsQ+N5Op3uiPgWDdgMC81EAxn26/sSXilZbc7IcI3ntIzp6LmUUgIQQ7Y/WT42kzYEJwMoviwhdQsUZGD3Vk7AEu2EquuvzEuYM1nV4AacD9iKba88AHKf+D1uZEpOXuM2L6ANpwggHdrCbelqAFAeyxWehDiREd+w1yQ2ex72piqZgHXBcjhA9wNZOjntCNUeAJpQ52dVg9TzfqvRnO3pEUyjEZ3T8ZparZnTvWP5wM+X6uWytMft+bOkvJM8cGWCupyPbLB0m8hNJr6gh8wLFeFBdpLlqtLBpqDv+q8suGgWnPF/KWYBAKSeurWOYbAknIcm5e1IdlDd/Cwha6LLoouYO/kTNaYKIhbMUqkrEkJQeALbId51kCHY80v7fvN0U/ILW+Z/twPx52KdsZM8pe++Hm7mHYk8JeYXpvbbdbbB3MBNMspkLPuPwMoTbTf7wMlJWFn488CMYrqhezCmJDqzXhhtmtJytiADQtrDc0ylKnAjSOjkWa0ZAc59AwEOjAPmQ4ElFGTrDE95W0XLV7JMp/srjpjVaCihjdkmhdG1218nm24axp8PGkrAxR5dRiwo3iPsnKvV8KwNPQNfmzYxHOn9bsoIAnH1IvJ3HIffHA7tv8ujgBpOFjMRSqgZY/HR25YtGT8Bu2dExKkbpsyr5fch+dZK8JZf4C5vjcehZ7kBSAmb8XM+5VRNYj58ISuuhNYEWf5wXoY249AqVAsHuC2nr+r43KqBcKQQ317R3ppyxXOknbA4RuooWou0guq5tVAu27cI1M5Z5thfb9CgekKaOrZou3TuFLTXQgBBX8C9IL/HA+Y4dd90s5gGb+2nKmp+wwjmtG5aBrW9stdh46VZr36q/2gzub64B8NTY3nVwEQJ/Mr4+5d9hFy+KU1V1DHkKP+v9DEFwrYis2VuK93z1gJTvr6SHAxhrPXB2T979oTdUzZtXWtNJjP5Z4hIqoh8QPC2jMxoHXnLnT5F7qb2Lqw7dF9XNxFiZbUwWrH3ajjhCAGFoZhHrH/fWDLe63ESH2c25MfTK/mP/RgWG73igCKcVuKoToTmG8KEWUllUsN6iTHsqZW67iL2sQ6vJLpRnOcsirV1QSjKZ2YtiupWl6OgmpTdWiv7jDNPa+8ZIny4s5fECROBREYWD4lSd29NlIsNstuYLQO3P0M6ZIUw4MtjENSYJhXt1Nr86by6m1+Xgy/lK1tZaDx42cEZl9rNCc1fMlbthjzrUVWKxSZqUJ5G0K+eQ6RagAvvRnjLRbZfw==</xenc:CipherValue>
            </xenc:CipherData>
        </xenc:EncryptedData>
    </saml2:EncryptedAssertion>
</saml2p:Response>