How do I specify the passphrase for a private key in saml2-js?

user_9731043 0
Viewed 515

I see the option to do this in saml-passport but I've already set things up using saml2-js. My key/cert has a passphrase that is required or I get a bad decrypt error. Is it possible to set this passphrase?

Here are the SP options

var sp_options = {
  entity_id: "/startpoint",
  private_key: fs.readFileSync(`${dir}src/certs/key.pem`).toString(),
  certificate: fs.readFileSync(`${dir}src/certs/cert.pem`).toString(),
  assert_endpoint: '/assert',
  sign_get_request: true
}
var sp = new saml2.ServiceProvider(sp_options)

I would expect to have a key 'passphrase' under the private_key key but there is no key like that specified in the docs.

saml-2.0 express node.js javascript
2 Answers

It seems that your saml module doesn't handle passphrase for crt/pem.

You can search another saml module on npm which can handle it, i didn't find one for the moment

You can probably manage the decryption of the pem by hand with an openssl wrapper / crypto wrapper but i might be quite complicated.

Otherwise, John Cruz seems the best option for no-code solution.

If you want to do it by hand, your encrypted PEM includes:

-----BEGIN RSA PRIVATE KEY-----
Proc-Type: 4,ENCRYPTED
DEK-Info: DES-EDE3-CBC,05E1DB4ACD187787

Which show you encrypting algorithm used, here : des-ede3-cbc, and the cipher IV in hex format, here 05E1DB4ACD187787

Then you have your base64 encrypted datas:

2rtyxqlZg/ROAHQRnYyHDpkdk9rgYVhsNrGdBzEySzUG+LRwTU/Z+ihSTKK0f2yj
Zpn/qOsXwq4IS6XOb+Q8M5AAbE7t3jKI14YDAvDK/jQpBLk907oxFqeNte3Qvmrm
OjzHJS/P1JXef4dByhrjlrdL/pNV9ov5dM8cyVcxRUbW6cNapXoSrlXrmNPM....

With node crypto module you can now handle the decryption:

const cipher = crypto.createDecipheriv('DES-EDE3-CBC', Buffer.from(secretKeyHex, "hex"), Buffer.from(ivHex, "hex"));
let c = cipher.update(encryptedPemBase64, 'base64','base64')
c += cipher.final('base64');

Note that the key must have a specific length, depending on the algorithm used

It's quite easy if your key is "static", can be tricky if you have to handle a lot of algorithm

user_63297270

By poking around the code in that library, it doesn't look like it has the logic to handle password-protected certs.

One option is to remove the passphrase by doing this:

openssl rsa -in key.pem -out key_nopass.pem

You'll be prompted to enter your password one more time. The newly-created file, key_nopass.pem won't require a password.

user_45086390
Related