[JIRA] Resolved: (SSPCPP-458) Unprecise error message when wrong certificate is used for SAML2 encryption

[Scott Cantor (JIRA)]

     [ https://issues.shibboleth.net/jira/browse/SSPCPP-458?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Scott Cantor resolved SSPCPP-458.
---------------------------------

       Resolution: Fixed
    Fix Version/s: 2.5

http://svn.shibboleth.net/view/cpp-sp?rev=3686&view=rev

> Unprecise error message when wrong certificate is used for SAML2 encryption
> ---------------------------------------------------------------------------
>
>                 Key: SSPCPP-458
>                 URL: https://issues.shibboleth.net/jira/browse/SSPCPP-458
>             Project: Shibboleth SP - C++
>          Issue Type: Improvement
>      Security Level: Standard(Standard bug, may impact functionality but does not represent a security vulnerability ) 
>          Components: Error Handling
>    Affects Versions: 2.4.3
>            Reporter: Olivier Salaün
>            Assignee: Scott Cantor
>            Priority: Minor
>             Fix For: 2.5
>
>   Original Estimate: 1 hour
>  Remaining Estimate: 1 hour
>
> While recently configuring most of our services to use a discovery service (versus a WAYF) we noticed a got a couple of errors with IdPs encrypting SAML2 assertions using the wrong certificate. This may happen when both the IdP and SP are trusting both our test and production federation.
> It has been very hard for us to determine the origin of the problem and to fix it mostly because the SP logs didn't help much.
> Here is what it looked like :
> 2012-05-10 15:08:40 DEBUG XMLTooling.CredentialCriteria [29470]: credential name(s) didn't overlap
> 2012-05-10 15:08:40 ERROR Shibboleth.SSO.SAML2 [29470]: Unable to resolve any key decryption keys.
> It's misleading because we had no credential name issue.
> It would greatly help if you could add an additional error log entry that tells the SP could not decrypt the assertion.
> Thanks

--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira