ADFS :Opensaml2 Integration: Signature did not validate against the credential's key

[Chris Phillips]

Too fast on the reply button, sorry:

If you are trying to validate ADFS certs and fail to (which is sounds like
your problem), ensure that the key you put into the metadata is the right
key AND has the right elements ('use=signing') in the metadata.
This thread from 2009:
https://groups.google.com/forum/#!topic/simplesamlphp/ZORJggDV5Vo talks to
the point.

If you take a look at the inCommon metadata you'll see some ADFS entities
with use=signing and some without (again, see above).

I've made the mistake of not putting the use=signing and have to monkey
with some configurations to avoid our assertions being encrypted since the
behaviour of a Shibboleth IdP will automatically encrypt the assertion (as
it should since I didn't specify use=signing).

Can you tell the difference between signing/assertion certs? Maybe, but
only because ADFS may use the text somewhere in the cert.

Chris.






On 14-02-18 9:33 AM, "Chris Phillips" <Chris.Phillips at canarie.ca> wrote:

>I've encountered this style of problem and hope this helps:
>
>
>
>
>On 14-02-18 6:38 AM, "smita.sree2007 at gmail.com" <smita.sree2007 at gmail.com>
>wrote:
>
>>Hi Scott,
>>Really appreciate all your help
>>
>>Rreagrding the points in
>>https://wiki.shibboleth.net/confluence/display/OpenSAML/OSTwoUserManSigEr
>>r
>>ors
>>
>>1. Ensure your keys are right
>> >> We had asked the IDP client to make sure that the private key ,they
>>use
>>to sign, is the right pair of the the public key the given us(SP) to
>>validate. They replied that, they use ADFS's token-signing certificate
>>to
>>sign, and what they given us , is the ADFS's communication certificate.
>>They
>>tell , those should match( I am not aware of ADFS config, so not really
>>able
>>to make sure the keys are right)
>> 
>>
>>2. Ensure your software is update
>>>> We use Opensaml 2.2.3. After this issue, we have upgraded to Opensaml
>>>> 2.6.1 and tested. Results were same.
>>
>>
>>3. Ensure the content isn't being changed by your parser
>>>> If this is the case, the flow should not have worked when we tested
>>>>using
>>>> , my test certificate. With my test certificate the flow worked fine,
>>>>but
>>>> not with the IDP'd original certificate.
>>
>>
>>4. Validate the signature with known-good tools
>>    -I 'm working tocheck this, for my working SAML response also ,online
>>signature verifier gave negative result. So bit confused on that.
>>5. Compare the content
>>    -This one I 'll work with client to get the pre-signed data and
>>compare
>>	
>>Thanks
>>Smitha	
>>
>>
>>
>>--
>>View this message in context:
>>http://shibboleth.1660669.n2.nabble.com/ADFS-Opensaml2-Integration-Signat
>>u
>>re-did-not-validate-against-the-credential-s-key-tp7595247p7595398.html
>>Sent from the Shibboleth - Developers mailing list archive at Nabble.com.
>>--
>>To unsubscribe from this list send an email to
>>dev-unsubscribe at shibboleth.net
>