IDP Failure

[Brent Putman]

On 1/15/13 11:26 AM, Ogunleye, Philip wrote:
> 16:21:50.058 - ERROR [edu.internet2.middleware.shibboleth.idp.profile.saml2.AbstractSAML2ProfileHandler:923] - Could not resolve a key encryption credential for peer entity: https://snaponglobal.com/SAML
> 16:21:50.058 - ERROR [edu.internet2.middleware.shibboleth.idp.profile.saml2.AbstractSAML2ProfileHandler:289] - Unable to construct encrypter
> org.opensaml.xml.security.SecurityException: Could not resolve key encryption credential


>
> Considering my metadata does not indicate that encryption is necessary I'm not sure as to why this is occurring.

The Shib IdP on SAML 2 SSO via a front-channel binding will encrypt by
default.  If your SP doesn't support SAML encryption, you need to
configure a custom RelyingParty for you SP and in it include a
ProfileConfiguration that turns off encryption for that profile for that
relying party:

https://wiki.shibboleth.net/confluence/display/SHIB2/IdPXMLSigEnc


If your SP does support SAML encryption and you want to do encryption,
then you need to add the appropriate KeyDescriptor to the metadata about
the SP that the IdP has.  That is literally the cause of the exception -
it's looking for an encryption key/cert, and isn't finding it.

https://wiki.shibboleth.net/confluence/display/SHIB2/IdPTroubleshootingCommonErrors#IdPTroubleshootingCommonErrors-MessageSecurityIssues