ADFS :Opensaml2 Integration: Signature did not validate against the credential's key

[Peter Williams]

Second guess...

I could not make a windows Kerberos token validate, last year, in a Java based world. I had to amend Java, to install various American export controlled policies for its cipher libs to validate the "modern' ciohersuite used in the latest windows token signing/encrypting profiles. (you should have heard me swearing about the underlying cause of those lost hours: us duplicity over manipulating crypto, but perhaps here is not the right place to rant).

Since your sp code works with adfs idp when using your own keying, perhaps compare key lengths of the public modulus: yours vs theirs.


Sent from my Windows Phone
________________________________
From: Cantor, Scott<mailto:cantor.2 at osu.edu>
Sent: ‎2/‎16/‎2014 9:49 AM
To: Shib Dev<mailto:dev at shibboleth.net>
Subject: Re: ADFS :Opensaml2 Integration: Signature did not validate against the credential's key

On 2/15/14, 9:26 PM, "smita.sree2007 at gmail.com" <smita.sree2007 at gmail.com>
wrote:
>
>Thanks Scott, for looking into this issue. We are not able to make sure
>the key is right.

Then you're going to have a very hard time.

> Client tells that they use ADFS's tokensigning certificate to sign the
>response and ADFS's communication certificate is the one uploaded in our
>SP server. The flow works fine, if the IDP cleint uses a test certificate
>given by us. So Will there be any issue with the certificate which , the
>IDP client used through ADFS, If so how can we identify? Is there any way
>to identify the mismatch between the signing certificate and the public
>key certificate? >From the OpenSAML debug log(attached in first email
>thread), I couldn't get any useful information to identify the issue?
>Thanks Smitha

The IdP does not validate certificates like that, not without extra work
in the metadata to provide trust anchors. Either the request is corrupted,
or more likely the key they gave you isn't correct. That's all I can tell
you.

I don't even remember anymore what the message type is here, but if it's
an XML Signature, the link I gave you has what you need to proceed if you
have no other information. If it's a redirect signature, that's a more
complex situation for debugging.

-- Scott


--
To unsubscribe from this list send an email to dev-unsubscribe at shibboleth.net
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/dev/attachments/20140216/22929ab5/attachment.html