ADFS :Opensaml2 Integration: Signature did not validate against the credential's key

[Peter Williams]

Having done this kind of thing for 25 years, I take a guess (and its only a guess). Guesses are useful when otherwise blocked.

The validation cannot construct a valid credential, since its has no context with which to validate the user cert itself - not being self-signed. That is, the cert should be in whatever passes for opensaml's trust store (of designated  root certs, self-signed or otherwise). Or, the parent of the cert, probably self-signed, shall be in said trust store. (I don't know if opensaml can auto-chain user certs to local superiors, or of the programmer is responsible for providing them, pre chained/discovered, in the cred structure).

Knowing Scott, a metadata file on a disk is the trust store, itself potentially signed of course.

Either you are  just pointing to the wrong key (as is easy to do), or the correct cert itself is "determined" by the lib to be "invalid", which status manifests as "signature cannot validate against the cred (which is locally considered invalid due to chaining)".



Sent from Surface Pro

From: smita.sree2007 at gmail.com<mailto:smita.sree2007 at gmail.com>
Sent: ?Saturday?, ?February? ?15?, ?2014 ?6?:?27? ?PM
To: Shib Dev<mailto:dev at shibboleth.net>

Thanks Scott, for looking into this issue. We are not able to make sure the key is right. Client tells that they use ADFS's tokensigning certificate to sign the response and ADFS's communication certificate is the one uploaded in our SP server. The flow works fine, if the IDP cleint uses a test certificate given by us. So Will there be any issue with the certificate which , the IDP client used through ADFS, If so how can we identify? Is there any way to identify the mismatch between the signing certificate and the public key certificate? >From the OpenSAML debug log(attached in first email thread), I couldn't get any useful information to identify the issue? Thanks Smitha
________________________________
View this message in context: Re: ADFS :Opensaml2 Integration: Signature did not validate against the credential's key<http://shibboleth.1660669.n2.nabble.com/ADFS-Opensaml2-Integration-Signature-did-not-validate-against-the-credential-s-key-tp7595247p7595296.html>
Sent from the Shibboleth - Developers mailing list archive<http://shibboleth.1660669.n2.nabble.com/Shibboleth-Developers-f1660781.html> at Nabble.com.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/dev/attachments/20140216/43db29b1/attachment.html