[JIRA] Created: (SSPCPP-458) Unprecise error message when wrong certificate is used for SAML2 encryption

Tue May 29 15:41:03 BST 2012

Unprecise error message when wrong certificate is used for SAML2 encryption
---------------------------------------------------------------------------

                 Key: SSPCPP-458
                 URL: https://issues.shibboleth.net/jira/browse/SSPCPP-458
             Project: Shibboleth SP - C++
          Issue Type: Improvement
      Security Level: Standard (Standard bug, may impact functionality but does not represent a security vulnerability )
          Components: Error Handling
    Affects Versions: 2.4.3
            Reporter: Olivier SalaÃ¼n
            Assignee: Scott Cantor
            Priority: Minor

While recently configuring most of our services to use a discovery service (versus a WAYF) we noticed a got a couple of errors with IdPs encrypting SAML2 assertions using the wrong certificate. This may happen when both the IdP and SP are trusting both our test and production federation.

It has been very hard for us to determine the origin of the problem and to fix it mostly because the SP logs didn't help much.

Here is what it looked like :
2012-05-10 15:08:40 DEBUG XMLTooling.CredentialCriteria [29470]: credential name(s) didn't overlap
2012-05-10 15:08:40 ERROR Shibboleth.SSO.SAML2 [29470]: Unable to resolve any key decryption keys.

It's misleading because we had no credential name issue.
It would greatly help if you could add an additional error log entry that tells the SP could not decrypt the assertion.

Thanks

--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira