Missing Metadata -> Encryption Key Errors

[Cantor, Scott]

On 10/19/15, 10:42 PM, "dev on behalf of Nate Klingenstein" <dev-bounces at shibboleth.net on behalf of ndk at internet2.edu> wrote:



>If an AttributeRequesterString match attribute filter policy exists for an SP that doesn’t have any metadata loaded associated with it, errors seem to get thrown regarding the encryption key being bad.  Given that there is no key at all, much less metadata, this isn’t surprising, but the error message was pretty unintuitive.

Not with any sort of default configuration.

This is what it looks like when there's no metadata loaded and a request comes in for an SP without metadata. The filter is nowhere near any of this process.

2015-10-19 22:48:57,796 - DEBUG [net.shibboleth.idp.saml.profile.impl.InitializeRelyingPartyContextFromSAMLPeer:132] - Profile Action InitializeRelyingPartyContextFromSAMLPeer: Attaching RelyingPartyContext based on SAML peer https://sp.example.org
2015-10-19 22:48:57,841 - DEBUG [net.shibboleth.idp.relyingparty.impl.DefaultRelyingPartyConfigurationResolver:289] - Resolving relying party configuration
2015-10-19 22:48:57,841 - DEBUG [net.shibboleth.idp.relyingparty.impl.DefaultRelyingPartyConfigurationResolver:295] - Profile request is unverified, returning configuration shibboleth.UnverifiedRelyingParty
2015-10-19 22:48:57,841 - DEBUG [net.shibboleth.idp.profile.impl.SelectRelyingPartyConfiguration:136] - Profile Action SelectRelyingPartyConfiguration: Found relying party configuration shibboleth.UnverifiedRelyingParty for request
2015-10-19 22:48:57,859 - DEBUG [net.shibboleth.idp.profile.audit.impl.PopulateAuditContext:220] - Profile Action PopulateAuditContext: Adding 1 value for field 'SP'
2015-10-19 22:48:57,859 - DEBUG [net.shibboleth.idp.profile.audit.impl.PopulateAuditContext:220] - Profile Action PopulateAuditContext: Adding 1 value for field 'IDP'
2015-10-19 22:48:57,886 - WARN [net.shibboleth.idp.profile.impl.SelectProfileConfiguration:111] - Profile Action SelectProfileConfiguration: Profile http://shibboleth.net/ns/profiles/saml2/sso/browser is not available for relying party configuration shibboleth.UnverifiedRelyingParty
2015-10-19 22:48:57,934 - WARN [org.opensaml.profile.action.impl.LogEvent:76] - An error event occurred while processing the request: InvalidProfileConfiguration


>If the diagnosis is correct and it wouldn’t be too hard to trap that error as something more natural, it would make fixing that way more obvious.

It's not correct, not alone anyway. I will turn on Unverified and see what it does. I would expect that the filter would be irrelevant in that case, and that if you left encryption on for that use case, you would get encryption errors. I would be surprised if you didn't. V2 should do the same.

-- Scott

>