{"action":"created","issue":{"url":"https://api.github.com/repos/onelogin/php-saml/issues/69","labels_url":"https://api.github.com/repos/onelogin/php-saml/issues/69/labels{/name}","comments_url":"https://api.github.com/repos/onelogin/php-saml/issues/69/comments","events_url":"https://api.github.com/repos/onelogin/php-saml/issues/69/events","html_url":"https://github.com/onelogin/php-saml/issues/69","id":81740095,"number":69,"title":"No support for passphrase-protected SP privateKey","user":{"login":"ciarand","id":2149341,"avatar_url":"https://avatars.githubusercontent.com/u/2149341?v=3","gravatar_id":"","url":"https://api.github.com/users/ciarand","html_url":"https://github.com/ciarand","followers_url":"https://api.github.com/users/ciarand/followers","following_url":"https://api.github.com/users/ciarand/following{/other_user}","gists_url":"https://api.github.com/users/ciarand/gists{/gist_id}","starred_url":"https://api.github.com/users/ciarand/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ciarand/subscriptions","organizations_url":"https://api.github.com/users/ciarand/orgs","repos_url":"https://api.github.com/users/ciarand/repos","events_url":"https://api.github.com/users/ciarand/events{/privacy}","received_events_url":"https://api.github.com/users/ciarand/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-05-28T03:38:40Z","updated_at":"2015-05-29T14:10:17Z","closed_at":null,"body":"In `_decryptAssertion` in `Response.php` the code both creates and uses an instance of the `XMLSecEnc` class:\r\n\r\n```php\r\n   private function _decryptAssertion($dom)\r\n    {\r\n        // -snip-\r\n\r\n        $objenc = new XMLSecEnc(); // <-- Create the object\r\n        $encData = $objenc->locateEncryptedData($dom);\r\n        if (!$encData) {\r\n            throw new Exception(\"Cannot locate encrypted assertion\");\r\n        }\r\n        \r\n        $objenc->setNode($encData);\r\n        $objenc->type = $encData->getAttribute(\"Type\");\r\n        if (!$objKey = $objenc->locateKey()) {\r\n            throw new Exception(\"Unknown algorithm\");\r\n        }\r\n        $key = null;\r\n        if ($objKeyInfo = $objenc->locateKeyInfo($objKey)) {\r\n            if ($objKeyInfo->isEncrypted) {\r\n                $objencKey = $objKeyInfo->encryptedCtx;\r\n                $objKeyInfo->loadKey($pem, false, false); // <-- Use the object\r\n                $key = $objencKey->decryptKey($objKeyInfo);\r\n            }\r\n        }\r\n\r\n        // -snip-\r\n    }\r\n````\r\n\r\nThat means there's never a chance to set the `XMLSecEnc::passphrase` property which is required for passphrase-protected private keys.\r\n\r\nIf you can refactor the `new XMLSecEnc()` call into a **`protected`** method then I can just subclass. Unfortunately `_decryptAssertion` is **`private`** and both it and the `__construct` don't really have any extension points here. Alternatively allowing a `privateKeyPassphrase` (or similar) entry in the `sp` array would also work."},"comment":{"url":"https://api.github.com/repos/onelogin/php-saml/issues/comments/106818423","html_url":"https://github.com/onelogin/php-saml/issues/69#issuecomment-106818423","issue_url":"https://api.github.com/repos/onelogin/php-saml/issues/69","id":106818423,"user":{"login":"pitbulk","id":600897,"avatar_url":"https://avatars.githubusercontent.com/u/600897?v=3","gravatar_id":"","url":"https://api.github.com/users/pitbulk","html_url":"https://github.com/pitbulk","followers_url":"https://api.github.com/users/pitbulk/followers","following_url":"https://api.github.com/users/pitbulk/following{/other_user}","gists_url":"https://api.github.com/users/pitbulk/gists{/gist_id}","starred_url":"https://api.github.com/users/pitbulk/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pitbulk/subscriptions","organizations_url":"https://api.github.com/users/pitbulk/orgs","repos_url":"https://api.github.com/users/pitbulk/repos","events_url":"https://api.github.com/users/pitbulk/events{/privacy}","received_events_url":"https://api.github.com/users/pitbulk/received_events","type":"User","site_admin":false},"created_at":"2015-05-29T14:10:17Z","updated_at":"2015-05-29T14:10:17Z","body":"Right now, we are not supporting passphrase on our SAML toolkits, but we will add that feature to the list."}}