[JIRA] Created: (SIDP-555) SAML2 encryption breaks after reload of relying-party.xml

[beall@usc.edu (JIRA)]

SAML2 encryption breaks after reload of relying-party.xml
---------------------------------------------------------

                 Key: SIDP-555
                 URL: https://issues.shibboleth.net/jira/browse/SIDP-555
             Project: Shibboleth IdP 2 - Java
          Issue Type: Bug
          Components: SAML 2
    Affects Versions: 2.3.8
         Environment: Sun JVM 1.6.0_33
RedHat Linux
Issue occurs with and without Terracotta
            Reporter: beall at usc.edu
            Assignee: Chad La Joie


1. Start IdP.
2. Log into SAML2 site requiring encryption of attribute assertion.
3. Touch relying-party.xml and wait for reload.
4. Reopen browser and log into same SAML2 site.  This part works fine.
5. Log into a different SAML2 site requiring encryption which has not been used since the IdP node was started.
6. See "opensaml::FatalProfileException" at SP with message "Status: urn:oasis:names:tc:SAML:2.0:status:Responder\nMessage: Unable to encrypt assertion"
7. See IdP exception in log starting with "org.opensaml.xml.security.SecurityException: Could not resolve key encryption credential"
8. Restart IdP.
9. Try site that was "broken".  Works fine now.

Changes to and subsequent reload of the metadata file do not resolve the issue.  However, changes to the certificate of the affected sites result in expected differing behavior such as failure to recognize the signature of the authentication request.  Fixing the certificate back to what it was does not enable encryption to function as it should.

--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira