_lasso_saml20_login_decrypt_assertion(LassoLogin *login, LassoSamlp2Response *samlp2_response)
{
	GList *encryption_private_keys = NULL;
	GList *it = NULL;
	gboolean at_least_one_decryption_failture = FALSE;
	gboolean at_least_one_malformed_element = FALSE;

	if (! samlp2_response->EncryptedAssertion)
		return 0; /* nothing to do */

	encryption_private_keys = lasso_server_get_encryption_private_keys(login->parent.server);
	if (! encryption_private_keys) {
			message(G_LOG_LEVEL_WARNING, "Missing private encryption key, cannot decrypt assertions.");
			return LASSO_DS_ERROR_DECRYPTION_FAILED_MISSING_PRIVATE_KEY;
	}

	lasso_foreach (it, samlp2_response->EncryptedAssertion) {
		LassoSaml2EncryptedElement *encrypted_assertion;
		LassoSaml2Assertion * assertion = NULL;
		int rc1 = 0;

		if (! LASSO_IS_SAML2_ENCRYPTED_ELEMENT(it->data)) {
			message(G_LOG_LEVEL_WARNING, "EncryptedAssertion contains a non EncryptedElement object");
			at_least_one_malformed_element |= TRUE;
			continue;
		}
		encrypted_assertion = (LassoSaml2EncryptedElement*)it->data;
		lasso_foreach_full_begin(xmlSecKey*, encryption_private_key, it,
				encryption_private_keys)
		{
			rc1 = lasso_saml2_encrypted_element_decrypt(encrypted_assertion, encryption_private_key, (LassoNode**)&assertion);
			if (rc1 == 0)
				break;
		}
		lasso_foreach_full_end();
		if (rc1 == LASSO_DS_ERROR_DECRYPTION_FAILED) {
			message(G_LOG_LEVEL_WARNING, "Could not decrypt the EncryptedKey");
			at_least_one_decryption_failture |= TRUE;
			continue;
		} else if (rc1) {
			message(G_LOG_LEVEL_WARNING, "Could not decrypt an assertion: %s", lasso_strerror(rc1));
			at_least_one_decryption_failture |= TRUE;
			continue;
		}

		if (! LASSO_IS_SAML2_ASSERTION(assertion)) {
			message(G_LOG_LEVEL_WARNING, "EncryptedAssertion contains something that is not an assertion");
			lasso_release_gobject(assertion);
			continue;
		}
		/* copy the assertion to the clear assertion list */
		lasso_list_add_new_gobject(samlp2_response->Assertion, assertion);
	}
	
	if (at_least_one_decryption_failture) {
		return LASSO_DS_ERROR_DECRYPTION_FAILED;
	}
	if (at_least_one_malformed_element) {
		return LASSO_XML_ERROR_SCHEMA_INVALID_FRAGMENT;
	}
	return 0;
}
_lasso_saml20_login_decrypt_assertion(LassoLogin *login, LassoSamlp2Response *samlp2_response)
{
	GList *encryption_private_keys = NULL;
	GList *it = NULL;
	gboolean at_least_one_decryption_failture = FALSE;
	gboolean at_least_one_malformed_element = FALSE;

	if (! samlp2_response->EncryptedAssertion)
		return 0;  

	encryption_private_keys = lasso_server_get_encryption_private_keys(login->parent.server);
	if (! encryption_private_keys) {
			message(G_LOG_LEVEL_WARNING, "Missing private encryption key, cannot decrypt assertions.");
			return LASSO_DS_ERROR_DECRYPTION_FAILED_MISSING_PRIVATE_KEY;
	}

	lasso_foreach (it, samlp2_response->EncryptedAssertion) {
		LassoSaml2EncryptedElement *encrypted_assertion;
		LassoSaml2Assertion * assertion = NULL;
		int rc1 = 0;

		if (! LASSO_IS_SAML2_ENCRYPTED_ELEMENT(it->data)) {
			message(G_LOG_LEVEL_WARNING, "EncryptedAssertion contains a non EncryptedElement object");
			at_least_one_malformed_element |= TRUE;
			continue;
		}
		encrypted_assertion = (LassoSaml2EncryptedElement*)it->data;
		lasso_foreach_full_begin(xmlSecKey*, encryption_private_key, it,
				encryption_private_keys)
		{
			rc1 = lasso_saml2_encrypted_element_decrypt(encrypted_assertion, encryption_private_key, (LassoNode**)&assertion);
			if (rc1 == 0)
				break;
		}
		lasso_foreach_full_end();
		if (rc1 == LASSO_DS_ERROR_DECRYPTION_FAILED) {
			message(G_LOG_LEVEL_WARNING, "Could not decrypt the EncryptedKey");
			at_least_one_decryption_failture |= TRUE;
			continue;
		} else if (rc1) {
			message(G_LOG_LEVEL_WARNING, "Could not decrypt an assertion: %s", lasso_strerror(rc1));
			at_least_one_decryption_failture |= TRUE;
			continue;
		}

		if (! LASSO_IS_SAML2_ASSERTION(assertion)) {
			message(G_LOG_LEVEL_WARNING, "EncryptedAssertion contains something that is not an assertion");
			lasso_release_gobject(assertion);
			continue;
		}
		 
		lasso_list_add_new_gobject(samlp2_response->Assertion, assertion);
	}
	
	if (at_least_one_decryption_failture) {
		return LASSO_DS_ERROR_DECRYPTION_FAILED;
	}
	if (at_least_one_malformed_element) {
		return LASSO_XML_ERROR_SCHEMA_INVALID_FRAGMENT;
	}
	return 0;
}