[JIRA] (IDP-1965) Assistance Deducing Error on Login

Wed Jun 22 05:30:31 UTC 2022

Hari Mailvaganam ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A2b739e14-de6b-4ce2-90d0-7974709550b0 ) *created* an issue

Identity Provider ( https://shibboleth.atlassian.net/browse/IDP?atlOrigin=eyJpIjoiN2JiNzg5NjNmMDNmNGM3NGIwNjQ2MDQwNTJiYTJhZTgiLCJwIjoiaiJ9 ) / Task ( https://shibboleth.atlassian.net/browse/IDP-1965?atlOrigin=eyJpIjoiN2JiNzg5NjNmMDNmNGM3NGIwNjQ2MDQwNTJiYTJhZTgiLCJwIjoiaiJ9 ) IDP-1965 ( https://shibboleth.atlassian.net/browse/IDP-1965?atlOrigin=eyJpIjoiN2JiNzg5NjNmMDNmNGM3NGIwNjQ2MDQwNTJiYTJhZTgiLCJwIjoiaiJ9 ) Assistance Deducing Error on Login ( https://shibboleth.atlassian.net/browse/IDP-1965?atlOrigin=eyJpIjoiN2JiNzg5NjNmMDNmNGM3NGIwNjQ2MDQwNTJiYTJhZTgiLCJwIjoiaiJ9 )

Issue Type: Task Assignee: Unassigned Attachments: illumio.xml Created: 22/Jun/22 1:30 AM Priority: Trivial Reporter: Hari Mailvaganam ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A2b739e14-de6b-4ce2-90d0-7974709550b0 )

For the attached metadata, the error in section 1, from the ‘idp-process.log’, is received when application redirects to IDP for login. Section 2 has the ‘AuthnRequest’ sent to the IDP.

The attached metadata was handcrafted.

Could we have your assistance on what could be awry with the metadata cert?

SECTION 1

022-06-21 22:07:16,608 - ERROR [org.opensaml.xmlsec.keyinfo.impl.provider.InlineX509DataProvider:192] - [EC1DA2D09F5EBC2F59CABFB04D890B2D] - [137.82.124.74] - Error extracting certificat

es from X509Data: org.cryptacular.EncodingException: Cannot decode certificate

2022-06-21 22:07:16,608 - WARN [org.opensaml.saml.common.binding.security.impl.BaseSAMLSimpleSignatureSecurityHandler:289] - [EC1DA2D09F5EBC2F59CABFB04D890B2D] - [137.82.124.74] - Message

Handler:  Error evaluating the request's simple signature using the trust engine: Error resolving trusted credentials

2022-06-21 22:07:16,608 - WARN [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:197] - [EC1DA2D09F5EBC2F59CABFB04D890B2D] - [137.82.124.74] - Profile Action WebFlowMessageHan

dlerAdaptor: Exception handling message

org.opensaml.messaging.handler.MessageHandlerException: Error during trust engine evaluation of the simple signature

at org.opensaml.saml.common.binding.security.impl.BaseSAMLSimpleSignatureSecurityHandler.validateSignature(BaseSAMLSimpleSignatureSecurityHandler.java:291)

Caused by: org.opensaml.security.SecurityException: Error resolving trusted credentials

at org.opensaml.xmlsec.signature.support.impl.ExplicitKeySignatureTrustEngine.doValidate(ExplicitKeySignatureTrustEngine.java:148)

Caused by: net.shibboleth.utilities.java.support.resolver.ResolverException: Error processing KeyInfo child element

at org.opensaml.xmlsec.keyinfo.impl.BasicProviderKeyInfoCredentialResolver.processKeyInfoChild(BasicProviderKeyInfoCredentialResolver.java:324)

Caused by: org.opensaml.security.SecurityException: Error extracting certificates from X509Data

at org.opensaml.xmlsec.keyinfo.impl.provider.InlineX509DataProvider.extractCertificates(InlineX509DataProvider.java:193)

Caused by: java.security.cert.CertificateException: org.cryptacular.EncodingException: Cannot decode certificate

at org.opensaml.security.x509.X509Support.decodeCertificate(X509Support.java:396)

Caused by: org.cryptacular.EncodingException: Cannot decode certificate

at org.cryptacular.util.CertUtil.readCertificate(CertUtil.java:258)

Caused by: java.security.cert.CertificateParsingException: Extensions not allowed in v2 certificate

at java.base/sun.security.x509.X509CertInfo.parse(X509CertInfo.java:705)

2022-06-21 22:07:16,609 - WARN [org.opensaml.profile.action.impl.LogEvent:101] - [EC1DA2D09F5EBC2F59CABFB04D890B2D] - [137.82.124.74] - A non-proceed event occurred while processing the r

equest: MessageAuthenticationError

SECTION 2

<samlp:AuthnRequest AssertionConsumerServiceURL=" https://login.illum.io/login/acs/61612b72-77e0-4ebd-932a-b7cbdde01ec6 " Destination=" https://authentication.ubc.ca/idp/profile/SAML2/Redirect/SSO " ForceAuthn="false" ID="_95f1b1e8-a9ad-46a8-97f3-40fc67c8fa32" IssueInstant="2022-06-22T05:07:16Z" Version="2.0" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" > <saml:Issuer> https://login.illum.io/login </saml:Issuer> <samlp:NameIDPolicy AllowCreate="true" Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress" /> </samlp:AuthnRequest>

( https://shibboleth.atlassian.net/browse/IDP-1965#add-comment?atlOrigin=eyJpIjoiN2JiNzg5NjNmMDNmNGM3NGIwNjQ2MDQwNTJiYTJhZTgiLCJwIjoiaiJ9 ) Add Comment ( https://shibboleth.atlassian.net/browse/IDP-1965#add-comment?atlOrigin=eyJpIjoiN2JiNzg5NjNmMDNmNGM3NGIwNjQ2MDQwNTJiYTJhZTgiLCJwIjoiaiJ9 )

Get Jira notifications on your phone! Download the Jira Cloud app for Android ( https://play.google.com/store/apps/details?id=com.atlassian.android.jira.core&referrer=utm_source%3DNotificationLink%26utm_medium%3DEmail ) or iOS ( https://itunes.apple.com/app/apple-store/id1006972087?pt=696495&ct=EmailNotificationLink&mt=8 ) This message was sent by Atlassian Jira (v1001.0.0-SNAPSHOT#100201- sha1:5c1db44 )
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/commits/attachments/20220622/d6b21542/attachment-0001.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-comment-icon-48788588-de5e-433a-a756-bc86f1eba4d5
Type: image/png
Size: 1084 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220622/d6b21542/attachment-0004.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-trivial-56c7d5d3-5cc6-4e23-80fb-e0e5862b374c
Type: image/png
Size: 563 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220622/d6b21542/attachment-0005.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-footer-desktop-logo-b8cf97b7-fe63-4b08-a7f1-a71f0ae775df
Type: image/png
Size: 10805 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220622/d6b21542/attachment-0006.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-avatar-0af25fa2-1187-40ca-84a4-a42564fd2f4c
Type: image/png
Size: 468 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220622/d6b21542/attachment-0007.png>