Upgrade OpenSAML version from 4.3.2 to 5.1.3

.github/actions/setup/action.yml

@@ -2,7 +2,7 @@ name: Setup
 inputs:
   java-version:
     required: true
-    default: 17
+    default: 21
   cache-key:
     required: true
     default: "deps"
@@ -11,7 +11,7 @@ runs:
   using: composite
   steps:
     - name: Prepare JDK
-      uses: actions/setup-java@v3
+      uses: actions/setup-java@v4
       with:
         java-version: ${{ inputs.java-version }}
         distribution: temurin

.github/workflows/release.yml

@@ -14,10 +14,10 @@ jobs:
     - uses: actions/checkout@v4.1.0
       with:
         fetch-depth: 0
-    - name: Prepare JDK 17
-      uses: actions/setup-java@v3
+    - name: Prepare JDK 21
+      uses: actions/setup-java@v4
       with:
-        java-version: 17
+        java-version: 21
         distribution: 'temurin'
     - name: Setup Clojure
       uses: DeLaGuardo/setup-clojure@12.1

.github/workflows/tests.yml

@@ -6,36 +6,37 @@ on:
 
 jobs:
 
-  Test-Java-11:
+  Test-Java-17:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
       - uses: actions/checkout@v4.1.7
       - uses: ./.github/actions/setup
         with:
-          java-version: 11
+          java-version: 17
           cache-key: "test"
       - run: clojure -X:dev:test
 
-  Test-Java-17:
+  Test-Java-21:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
       - uses: actions/checkout@v4.1.7
       - uses: ./.github/actions/setup
         with:
-          java-version: 17
+          java-version: 21
           cache-key: "test"
       - run: clojure -X:dev:test
 
+
   Cloverage:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
       - uses: actions/checkout@v4.1.7
       - uses: ./.github/actions/setup
         with:
-          java-version: 11
+          java-version: 21
           cache-key: "cloverage"
       - run: clojure -X:dev:cloverage
       - name: Upload code coverage to codecov.io

VERSION.txt

@@ -1 +1 @@
-2.2.7
+3.0.0

deps.edn

@@ -10,11 +10,11 @@
   hiccup/hiccup                       {:mvn/version "1.0.5"}
   org.apache.santuario/xmlsec         {:mvn/version "4.0.2"} ; use latest version and override transient dep from OpenSAML
   org.cryptacular/cryptacular         {:mvn/version "1.2.7"} ; use latest version and override transient dep from OpenSAML
-  org.opensaml/opensaml-core          {:mvn/version "4.3.2"}
-  org.opensaml/opensaml-saml-api      {:mvn/version "4.3.2"}
-  org.opensaml/opensaml-saml-impl     {:mvn/version "4.3.2"}
-  org.opensaml/opensaml-xmlsec-api    {:mvn/version "4.3.2"}
-  org.opensaml/opensaml-xmlsec-impl   {:mvn/version "4.3.2"}
+  org.opensaml/opensaml-core-api      {:mvn/version "5.1.3"}
+  org.opensaml/opensaml-core-impl     {:mvn/version "5.1.3"}
+  org.opensaml/opensaml-saml-impl     {:mvn/version "5.1.3"}
+  org.opensaml/opensaml-xmlsec-api    {:mvn/version "5.1.3"}
+  org.opensaml/opensaml-xmlsec-impl   {:mvn/version "5.1.3"}
   potemkin/potemkin                   {:mvn/version "0.4.7"}
   pretty/pretty                       {:mvn/version "1.0.5"}
   ring/ring-codec                     {:mvn/version "1.2.0"}}

src/saml20_clj/crypto.clj

@@ -76,7 +76,9 @@
                  (= (.getNamespaceURI element) "urn:oasis:names:tc:SAML:2.0:assertion"))
         (decrypt! sp-private-key element))
       (doseq [i     (range (.. element getChildNodes getLength))
-              :let  [child (.. element getChildNodes (item i))]
+              ;; Explict typehinting here required by Cloverage
+              :let  [^org.w3c.dom.NodeList nodes (.getChildNodes element)
+                     child (.item nodes i)]
               :when (instance? org.w3c.dom.Element child)]
         (recursive-decrypt! sp-private-key child)))))
 

src/saml20_clj/sp/response.clj

@@ -366,7 +366,7 @@
                             (apply (partial merge-with concat)))
           audiences    (for [^AudienceRestriction restriction (.. assertion getConditions getAudienceRestrictions)
                              ^Audience audience               (.getAudiences restriction)]
-                                      (.getURI audience))]
+                         (.getURI audience))]
       {:attrs        attrs
        :audiences    audiences
        :name-id      {:value  (some-> name-id .getValue)

test/saml20_clj/test/response-with-signed-message-and-signed-and-encryped-assertion.xml

@@ -1,27 +1,16 @@
 <?xml version="1.0"?>
-<samlp:Response xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" ID="pfx9f36c9be-08d4-9d62-e1ff-d6f8f99e1e1d" Version="2.0" IssueInstant="2014-07-17T01:01:48Z" Destination="http://sp.example.com/demo1/index.php?acs" InResponseTo="ONELOGIN_4fee3b046395c4e751011e97f8900b5273d56685">
+<samlp:Response xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" ID="pfx4adc6cb4-d390-77ee-6ae5-d5f798badfca" Version="2.0" IssueInstant="2014-07-17T01:01:48Z" Destination="http://sp.example.com/demo1/index.php?acs" InResponseTo="ONELOGIN_4fee3b046395c4e751011e97f8900b5273d56685">
   <saml:Issuer>idp.example.com</saml:Issuer><ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
   <ds:SignedInfo><ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
     <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
-  <ds:Reference URI="#pfx9f36c9be-08d4-9d62-e1ff-d6f8f99e1e1d"><ds:Transforms><ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/><ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/></ds:Transforms><ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/><ds:DigestValue>/v0rYkGv+IJhiyT4vYtK8AHkBWo=</ds:DigestValue></ds:Reference></ds:SignedInfo><ds:SignatureValue>Zd8AP8YpdpHtW10T6UvcMqKiXJpYBFsges9UnVX58yzEEYnz+Sxds0JzvkTSO7AUgWnY5LJQu+p9j2eQJgif9RGDcj8W1bRTTHXBwKT70+4V68hMaMyMWc4aEmAHWWRM099dC2ymkaOBl9x3tSB5Mvda0FgFD/cdprNbefI2FSA=</ds:SignatureValue>
+  <ds:Reference URI="#pfx4adc6cb4-d390-77ee-6ae5-d5f798badfca"><ds:Transforms><ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/><ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/></ds:Transforms><ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/><ds:DigestValue>o+H48AO2W6gUqzeKMbkzGFEeiGw=</ds:DigestValue></ds:Reference></ds:SignedInfo><ds:SignatureValue>XusPe0BSQiUsORxARxPzOP0u44i6eZgBAKdQfBz+G6Xe0sQ32FOy4R4bRIqei1lCqG7TlJ9S10H1zn5ZNKFLzAkbvMZV0eKutdoyTO7YnCMUwkmS1NFNU0gpu8H2bCpNOxsUmyKcsnhvN6XEoApJZb+E5deXi2fPqBoX2sc9K4U=</ds:SignatureValue>
 <ds:KeyInfo><ds:X509Data><ds:X509Certificate>MIICajCCAdOgAwIBAgIBADANBgkqhkiG9w0BAQ0FADBSMQswCQYDVQQGEwJ1czETMBEGA1UECAwKQ2FsaWZvcm5pYTEUMBIGA1UECgwLRXhhbXBsZSBJZHAxGDAWBgNVBAMMD2lkcC5leGFtcGxlLmNvbTAeFw0yMDA5MjMxNzQyMjRaFw0zMDA5MjExNzQyMjRaMFIxCzAJBgNVBAYTAnVzMRMwEQYDVQQIDApDYWxpZm9ybmlhMRQwEgYDVQQKDAtFeGFtcGxlIElkcDEYMBYGA1UEAwwPaWRwLmV4YW1wbGUuY29tMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDOqpTbp9VJq0aXQbV6duEDGm8Def5F6LMtSgOkNb3GVw5nBrsQtxI2R6aBwgVpgNbkbG6WLQxRWEpEoSbKM0kUle3YN04+k/e7+LkWrzBx3dykdhEqF+gQyK7fWjfj35UJqReM8cSzxUHQKHBcL+D59VAyJC3sA1mvuKsS/7RIMwIDAQABo1AwTjAdBgNVHQ4EFgQUviPb7EZV3vBqOlKlyxI/Ps2Z/9AwHwYDVR0jBBgwFoAUviPb7EZV3vBqOlKlyxI/Ps2Z/9AwDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQ0FAAOBgQBus/4hCWuEVWX882TaUXmIr3yMuICxm+5VEt4dmiQrj6miJoV6kNTPuiyskPe5SK/5VBJMSSm1eqbW7nTaUYrnwUaYT8UBAfkBgAEM/PhuI8cBSC3YoVPZwQbmywKMsprSMfE4K9eOyay9796lddrdMVkD8MgD8Z1i5+vvw7kpcg==</ds:X509Certificate></ds:X509Data></ds:KeyInfo></ds:Signature>
   <samlp:Status>
     <samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/>
   </samlp:Status>
-  <saml:EncryptedAssertion ID="pfx210ac9a7-b8ad-ebc7-1f24-5e1a13a50f6d">
-    <xenc:EncryptedData xmlns:xenc="http://www.w3.org/2001/04/xmlenc#" xmlns:dsig="http://www.w3.org/2000/09/xmldsig#" Type="http://www.w3.org/2001/04/xmlenc#Element">
-      <xenc:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#aes128-cbc"/>
-      <dsig:KeyInfo xmlns:dsig="http://www.w3.org/2000/09/xmldsig#">
-        <xenc:EncryptedKey>
-          <xenc:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-1_5"/>
-          <xenc:CipherData>
-            <xenc:CipherValue>bq3XdFQAU2ngvVuJKdrgMPEsayQTOg5ezxz0Nk922WjA2AB4z9b+xgO1X6NCI6A6XHyplohFnnyOLM5XQaVRtzgIoF6GldOJboGaEroAV/2935cLhEeofPuM5CoQL3M91XVNhQ75l/EjbekAnwi2N05lCVCMG80I1WDqsxujzkk=</xenc:CipherValue>
-          </xenc:CipherData>
-        </xenc:EncryptedKey>
-      </dsig:KeyInfo>
-      <xenc:CipherData>
-        <xenc:CipherValue>6Gj74ash7B7EDMS4MHI+BrqSAyTkZT2/k1vbM7uw31QvzwwGXtzr2Ix1lrXFiwTqoduYKP2jLDWePKFt3jEPfwtxB9ScSKYzL9FLmLM+OaHZSgecl5aAv9E8/vZXoKPEGj0CurN7igg43oVlbz8m5iBPmM4uMt3rBqlL4OT+zNK13PdOT5xmsTM5hq8dGYL2Jh8yKOhLc0Qk1Vw7/4pry9mWjyeYtYcboM/KWIzE3y5Ef3+jgJbfn5zBlIh/MJirk2e/CxI+0wpZ3vpj/IWQTA1w47ggUm3qs44Z9cTbBeXUWTG2LoWdP+MYpjoJkAP5kBJs0Z5UHrruQn0/RdbhSC0j4G1n1aCdXoquMtnP//23P+i/Hk4eHN1EXi3DlA17AZulkQaUWXz+WuQH9w0q/MIOk0Yo6osHVSt0QFLp+oOOAsBIFw6RfhYrIGutnTeyCeoJ4PybW+VIE5eCN8YVYFK5yOBB2kNAM0YrDiUY/EZ5p+yPy/kR3Gr0jrbewcNRtmEzGeqOGdUzOioSpzr6i4kJmMJ1NAVl2MLDqRBNe8/7shZq8YHc4j5jmAeiijHts5ZsKFTgKy8p3WIM0gUMRx9VeAyQHCKeolppfyBZiCEJJgrtK9kRqLSKLOP9OL0VP5dxne3z+UjwOwygcE87ORbeOKeh8f/VtQV1eO8uyI6LhVB0GfVaofQeCJ4GbQTOgf5GVtOxyaCA++mqdwTQcF7Nvo6pye8ADbsE7GhnsTNz1W1y23r/Z2hUQFw0uWX84KpHxAkbo6pS8QHU3lLQptSS3WXDu2BR7W1AZIB1rpiEdYtGQZ2vkEvt1exfazlkqiirA9lcw1vuYGyhGeYAHSv0RjVH6PTOb6bfUHVZvUhBnk7bpaM9MqjD7WT7lfGfQSSOd7+WZIckEe5OKDOBX65XlGfYJW9E3Wo25mxN6c7cwz4tct2FI36zF4mG9UB0resfhykQZSiuTzG7YH9RvfvYUBErs506egGs4BWimbfkx89GT0yLhi6qHw5C6uahAvD4uQho37jUI5Gmeq/t9w3Z+QmXuXEh0LOWVgtN6bQp4qKpVJ8Ui9/RPAf0S/UgfYxzpTJFT9e3sAPonUfM1oJ8H46QOGSV4viZKgRkm/jETJViucmvjw/SOFtFHH0J1Cmon9BjWDK0ZhCjyYEXMXSBQHNUPmRogaT0fZOp2xa4U/IFy+ycJ3hmOdMfctoArSxdMqmyHg9VQxtZTpM/z3RLCDbY0BJ0nsSzaR3LqlHN9ZtZoIQXimvbyHX2YQTJYxVYNfYjv5/J7PwFx5pbkEbZzbh8lPShYUSDRADK8His5z24MYqnELPEGVpRLdXxXh9I9TCI5QfC822YtKWm125DW/3KYvlkIBnpNpbKU7PqTJC0WuCI6O/9XRqu48euYBbI0xo+NNouvhX91YX6BDdiJFgOZnHYWnNUhkLQirP++fpkpDSFKnDInnQYmuVq+TcjChCFJ+jka48xCJtwN6d61yKOGhO0a74wnV81teJejd/hYWbObE13VkBSPqsal56Nu9xFG+lq+pbSBohR+yvRnzL8gycjUXYov5LWMp8DxXdOs4oBmjPDo5zztE8gsNfoj6BakdilFgk2NT/rPPBrpxFw87oUHRamQ/8MQj9BmhF2IMEQZrDO8K2IXNFWzY07uXxSVBH1MxlUD/nxoon6c55DGJFqrtruDzG/UXN6Nw7fsWaWjfZRwnSOImUc/RmhnbDmJu5/W/xoBuTS4C/XvwiiKokAihBnglGMQ4umykqV5ljp4CFjZQNLlmV85i3+/xPBPsGmercl383Kjl9My+mFeK1MAJ3vyJaMCnXwYqkn+nhhHLxTzmLAYFEzJ+4EiXQMDBui2Of4mdulMaha/nBqf0d2M9lquVSuL7ROyAwEY43NDnVv1J4iUM9FfBvgrkduUOj+fT1U4ZJc4E3A9fz/vjdMos8U52nPlARErAy5/v+bkfhLe4hiYTqVgu0/YTI1220m/IvWYo7N3QzmqaGGo9s38WgbE6ZxD/frzVnQPNn/D+8l1nRCRJRqmvC1YYNkJYxUlv+bIQI7unafBJneJoepjihniqubjJ58v/NN8a3BIdbw0vm7b4SpUnMIbOMeHPzcTc4ESB2B+XpFIBGp8fE7YIYWUbQ2FTINnjJCw/4gAmxehZCJ+nk2HgICXIkQ/DT0h3JFBAVBT2CraObK5pYHlL9u2ph3bq8/CA1PsTrN/oBc31uIX0MhkNU50dbEuWG6YW9JX+IYUUfKEqlwuA8efOrho5tn0bpZvisJ26fisVVq666PewhDWNaKy2V2mlLn2XVUNE3/nMtHNyha8ghsc/aM0pXzkgATNHOVpzlGXcEFlFTiyg2KpgNaPtdq4SyL6N0pBtRrnWij3rTh359uMTcOYDMAG1w2vKk3HHyxF9lfMeSZbKloKX0c/w7SHUlE0Yka/9dSi5sbg/oZEQWZVlQY4PTaqbP4apLCVISNd0k/PvE6LpFoyuAJM+nOiIhY4BOBWZL5yitS3g4+xTfavoBieKPcat0p8W38ZUV3LfulikVXn/nyTPTO6BYooqbSVXUuVQKpm0utFNdE9ZF8JdnEiQ6Box8capPR1b2tzPlW9TUiJYmi4qY6i+TPJR+E/u20/hzWMZzyqwoQetR6c0rYqSfoteJtBfkDedYO82SZQw/ZkpxvnC873+bI9/YGBF6GceUfZX6Fu0TLW0slbo3vxFnIBzW4+LzFTWS5wIk5cZsLGH/nj/tEHdspTPW9kK8WD+xkJPZVM7mw0OyTR/v7hEGB3hiyN+V6Znjn0CxR18F9PiawlyDCzgOfFDR2u5fmL435gNDswuCDzW2tgWg8Wn5kQkFF4bJr1AjCEO8TKP7aNHAQLCMIH8g8DkkC93cKgtzFphNav6FUedaxaoeoOW92bGw=</xenc:CipherValue>
-      </xenc:CipherData>
-    </xenc:EncryptedData>
-  </saml:EncryptedAssertion>
-</samlp:Response>
+
+<saml:EncryptedAssertion><xenc:EncryptedData xmlns:xenc="http://www.w3.org/2001/04/xmlenc#" xmlns:dsig="http://www.w3.org/2000/09/xmldsig#" Type="http://www.w3.org/2001/04/xmlenc#Element"><xenc:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#aes128-cbc"/><dsig:KeyInfo xmlns:dsig="http://www.w3.org/2000/09/xmldsig#"><xenc:EncryptedKey><xenc:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-1_5"/><xenc:CipherData><xenc:CipherValue>jIbl+4Lppnx8ExjYQANOM3yY00xsmU9/9FOWpOB8mT0biAo+I6D33j3EVqFvfZqbfD+Eisk1msoTUaGQ9AR0k4QCgwoIwskafvh9mbLCsD3siMhnbdMiM3CPK5IAvGwUyc3yO97FFaSMV0JuQQ3cvNMo9OIPpdZu5VIvRrNsmfQ=</xenc:CipherValue></xenc:CipherData></xenc:EncryptedKey></dsig:KeyInfo>
+   <xenc:CipherData>
+      <xenc:CipherValue>fSopuN4yWlTD2KBceF6cUA8qHR4XV6Ywvw2Dq0DhAEvoKuVkarOK2rpMsGi3cdum1jFJimwd73igrW/EX7U3KM+Kg8VWOEDPWUhphin6I4TYhoq21IWIkwPJ7mxdvJDjImKKN9zGcjCxmBSLkNbwXcCcUwQRlMXg3tHSQ4gKXNpQSEw84sS64ojpgSevyZVxJeL4tuJtwibzAcg285W16ycva1AmEVqjxYSAVIEkbLVeoNzabFEsZ0siz33+qCJw9A+Rrcpoe/Jsihp0h0QiBWvyntvFxKL+ebEEV0pmocg4h/mLthNdD9uF9jituHXhuQQY/zUnDK7ycSXE9BhsNm7Aze2AI0DjQ5dFPYayuXoeqjRAOVVAJe1izoVGlDUKh2LRqjaHxyCS2rTrAN7en1mEPje9undU/UZ+alueydqCd6kF7Wxx3g1iHG8hYJaD8w8nnnBLH7mwEec1qjreuc1DUVbir9a/9oIjqlTj9PRPHOT7tpYsINj7Il9Y2TL9azz1X7y9Jwj4OZkoTder/nIV4R0V1PDXn101rBB519bz+5iKcu9LpOxnQIgL/jRWs628JZtBmh4SqA6PSgwKqZXRNoHSIWp6tCbpCrrPdOhdN8NUlQgc59ys4Rw+6bxlZ1b0LIwnsALS1biPWChDxdQQboSnftLKhGBEyH8RwkBP1QMTKTB9fy8GFSSpISqOTu2AtCq6DSDs+ZMjEeb9Uq0zkvRJ0Au4n7avcT6Asv6FJUEI0EExqkAyP/jcdOnIthPWEWHRDl9n+SqN9qilUeK1L3wqX/vb6itaxyGAX/ZhMuA2NnN2GLtcep3jmu6ZSB1lEGromGAkavoA1jc0V71Qg+1Zc355vgUdWCBtveub1QWLob6CwkTUW0o/XBXC4D8llnO1fjimElax2nINqzr7ED30ZBOWX2bZDHhwXGgjAOWAAetF2NryRb9IWPPntr+q8E93HBoiedNGlM/fXCmmGeZHUV5tq4Zv26L5YODSVPQnXzV6Ta66yMShaD3/i+v+0vr/+bq/C5ZZdUOXAb/sP6SiPolrn9XE+n1W6xXyEtVwJ/+eSEk4wPfxwDTFWA7Q4mV58ewwkCBoydsmvKEgcWqmAro81EYre5/cqSHfLc/5aBP7J8SOjGCSBoXMpwzuZoJwFRo6kjjf0nrM5rlG5PDOHw3rwOStJKq6e7th2tH6er+P1IKJya+NqUFDbnmNKFmFewHGg9M5fQ0VLLxAXAKjjpde/vp6r2Etl60mm4ZbsJkQkWuzOsqBfkj4BbBIouRh/20lO/Oj7sK3gv+rC1Hx6arFj4NrFJ3VhJf36Iwm+bUMzQwR3AEbFfov6UwBA2h0/T4KTn+4txMt4YEsQLWA5FufaPSRLvMqEqwXPQrL6IXNC1XPDK9s3PGOrsKPhAskJNVM//Bij2N0M8r3+Z49U1+vTEJZY07zm3Zo4FZomX99dYUaqlLVc84F/YO3vM0qNh3n7WHuTUT8CCDBwGhs69rKPv074dFN5RWgy8HuVCH3za7OSihM9zO7CE4AErhe/LPU5ySNKM0mrXYzLn9bDgKwDwD6Hz4YQDr+0JTpWY4NX/w3kpIINxHB9z1Ga+AlybcPQncqB6xc9FBTI5qHkavwgyb+ZW4O5NZ/A+gavOWDkalH56Syqpxp2MJivOD8prvGR/RImUBl4EZWnWXRfRoxAcuklRnPv8M9wjSLTMaqqWRYl79ZpCN5qBfbwHQ43jE71Af9M/0HxAMz6LGuwmCUo1qdva7XLl4dcm9V5FmMwxRwCcoEclNeAgtaZAGpu2UCgg6E8skagNvKqQltTtT+uRxrlWIWdEH4zyIwQ3R8/NnEWfdkVnxhDl3Ae0BfTI+TL+KoxkozeN/Fbm3NL9lyaKXWYHf+lJv581u/Iuri4jzyemp6ql8h6uzYAi1j+8JGxrGrJK+bRuvM9H8VZdG5LDeC90vGQnJ7rfGIbqJoS3InbJIQwIkASTylOvGG+vW5JLRM+SUYi6XsYFhvDB07D5GLnNYcj00lMgfQxdvebblRv6jEdP7DKsazoCfW+tPvKfyv7rJdQOTZC93PMMnOhHzWQYyqZ9z5lMZdt0JznOrlcXJkqd419j00KiZXseSQV4l+H+KzpGBh1YAjxWfGWaAgCRoLgACvJ7N/4bACy4jImDiqBMGlHmfnjS+c+hwWhIuajeCXDxj8vZ/kO+W6PScuiiYY6TcIGIsOFawmPiXDWgVMVqtm7hRVWDClHfhHaEsB8iSMhBRbdQs/jpy6r8DkRGfZU+ZbP7/IznW/FfBABc9Gz55hCQ/lqiDGWNX47LCy262Nhc1gqKpYR7BJnakfg/XCSENeiYL+0PPWlzzRX0N3NNLzdXSdhjtshfoSkMYPalTUxU3ooXvv4kRhG1UsFt1E4KwyQ8VTsF800y69jNsZk2jd1uYEUcQvjqNzjnSdxKjcINHvqaVqXc/v//Dhz58MDdQFrYsaSMMdTMTBvhtCWQlsNHA0kjwZAKO0dRtvFgXnD4anZbRxsOJ2sq/xtqXdXQ6WgpITEvYoC7Ik746n8S7V9nJeybVrZd+yTfjWQaLWXXdNpbFNTm9NO1Oq9498qdlPFScWp330aR7ZBg0XoOi6QAoaMj6ToQDSHPze2ag3V1Cb78QBBvfEEiRC6zDrX4EEwa9YXdvi76FiXKaYuAh1WuBxFyNMYoL20fP0PlKRY4rx9uInztAkOHlqPSOobdtApWhgj2LgpE5m84NzTaibOK8bNxe6rZe5y6GEHKTfWUBzJWTbqBhQvMqfAnuH739ZveWgNgv2eEPBmW5MGMKaYvrtp9BfvkRXBv1YkcWKC6wjglvvwMTgJ2u1uDddo3apTmU3DGVVBSTxnmMJxOcE1Tk9AW08kDQ79cIBAIWZImXCZsJMeOUBTyKcBruKWfJu7IPhkiYA4JUEW8wQtje6Gg6620qxKV5CGNSkWnRDTVSLcuEE4Il/YOtihxYSGGMfvHj7VxpP4n5+Ee/9G9iRMvnZtcoudHn+6l/tNp+e6bqNfDbaDvIffEXDOb+sbu4FUdwyO+/Ak3uGoiDRGigL6lmyKMwgHstud5sdOWD0XqraBTZfleYsrrwJbVzKjEW1nakDP+HvL3wGLCC2o6FLr/gFfGlEmQ1zItcJOOQWG+YCEnpiKIXz1DjVJoCIeTc1c2U300CHknENXOjtKSPQWmovubEGHSM52oa+0tGg02IQz7b1Qk9YFe2unUAt5goO96aYlISLyVO/P6MQSzK1Fkwte5KdTcj4BiHVZ2RkM/UzVvvUBydnkWaEtMre8mPypPO6uAKuM1sf1svzarwO9z9v5bLG0JfJzmSjQ6gtWG4aYXMPnZ3GmoXb5Hp9zbzfxg/54XEPrQKW3ogJAic+E0rD5bNascD/adbV1aUCd/9RTr+IvtYn8SU23W6z9EaXcyWEx0K04nxRwIFmQZIKDpxIPeGr19TSkXKWkqqwEbhGrb5tPskwpSYDaTSnHZKCkfxVCa5tWnGVpOcs+OFkqJUajWiwZL52MD6W06JZBFmyf9OkSE5Wg0LpFfWGzFJ9CWJCUGjzl60ERhTYVAAoJZDeQWmw7Sk9Z5h7pPyIWYdizBsXik/FSmST7MyhYrSgQ79idMx+ht3LEzmCy/YZ8zEbp/HShyDKOtMkKFPXG193Q8eGgEwms+U7M5ameFn7xzy81fK7Zq6Kl86ArxSTYZuTXi75PvL3UBO+4fBk/CQG4sQeDo6wIYKiZylMf33Jg1yitErDWCYGiTcxjdBbnapFK6cNudut2n+5DoqzADSxBDGLHaLH/XUx9N1+eCZvSBbkL+b03GeyHL6Tdd3R3Ob/iPrr+PrPAjDs63wj/iWAcYQcl0DXM3G2ZPs7UcbgRorrZ7FSbAxPgiRR6qlp7yGsV3IuddaRh+5psImy4ybw2V6KJYAnoyaEx2PJlIEJHj/b2BohSssODbTmgpP1oIrtdD3blOzPWj0qDUvPs/OWj2Zamqh8X4U0wARtaLEvpcvE3IoTnaXWgoj3cQSkYlFyWduRGlRewZCfojZ9JufkhM1X6nrqzgk/iSKJK27kDydwMzR49/etxZZRyai8cDGVx+SojeHP6x5sbfunvrX1Uh4CLIIOKUaK5nMJNrJvlyh2FJJhPq7hAz8/KA66cGFU6ADUTiZ6SqONy5eZyJP2vignbZbUsZM0d4Kx6bSsnqRVhGfTlRzbR3Ye75Wd7k47/ZSmeV1pAwSaQ46FauXJrq/zV+IqeNAhkinEm0UVaeh/q+6tiQe29N7A5L/rmsBXHpgjUXS0TmPppfNonbrV8odOwm9LwfSWUlXBe+zE/9fvmdLhHj6uJ6ZUpyY0ehDlbbeKkchYsL7YPlnhVd9vIwePsibXawZ54Gh5Iz9o4jAo0IWS0l0GL9O/qNrOaZuh/GHC3A2jQuYLc0i4uBfdPrdGT72DUTWz4sSxBsAY+UT2VxHsrvVOxv0crAdU6N10QaP/MLZktJA+O00TX/y2yYU0BzIK8+6KjqUD9XwMi5qw9USYcwoFj8FKcQrAYyQva6of9cjBbq5BK6YmiXiLuAlQl2tN+mYgb9TQB5Fea7McDDBqqfPmiKcmuqcaxtN2DDer1HgBd7rIyApLGk89ox39cA3OkBp7j0PrKdds1RQzPtf7zBFw9KIKAD/adnkvd1CoJbPTn1/plVqmZ5W/9z3bjEcIFkD4uod34h7N/oUftCdYfJ7SIc7rL0B7chqXaAl7r54Q7ZWxYOz4gFADwDwl8brK+pvYlFg4uiKaXpWT52cJY75rzVb+P4PfQzYlVyIjc92KWoZ6pOhhAXV1jPtqAKDU/S6dHS0tZJF9y7we5kON0w8FzcmeFxbkKihi6r2L788INapKcG0bf6bx9OzW8vJqRMYX/OFnSepJbhpt/VA3mFwMMJT56KcfvWebo/XbRHPrjC1UGDM4okJpbyEpmIXJDxh7k7ctWo3xqfQD9f2lDdMB0UWY28CpL2nCbkc7Pl+905DHNXx0HKS/dLf9ofVi4dzyw8oDLr1vFYHiiQN2AsMhnH800eQBqOe9zoAoUSa/ZJ9QQsURy6G5+Jz5IP7mIZGu5vMgjd6PDRv1TjQ5z8rPTkRo22y0Ggi3hFgrHCwDnsiBDAhbVYN5rc+x2Ppc4BKfq3mLk9L5knRvCqpkyR/asHK/21sdiaouwyn9O5thTcWLdmhCdh7WhXtF10pEXO0PRNKzMXDfBj3JQwKNTTsPLMuJlCbrp9N3Lp8ObKxrfj4bt3GI7174xLwXjaLqpudgWK1YJ7Y=</xenc:CipherValue>
+   </xenc:CipherData>
+</xenc:EncryptedData></saml:EncryptedAssertion></samlp:Response>