<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=windows-1256">
<meta name="Generator" content="Microsoft Exchange Server">
<!-- converted from text --><style><!-- .EmailQuote { margin-left: 1pt; padding-left: 4pt; border-left: #800000 2px solid; } --></style>
</head>
<body>
<div>
<div>
<div style="font-size:11pt; font-family:Calibri,sans-serif">Second guess...<br>
<br>
I could not make a windows Kerberos token validate, last year, in a Java based world. I had to amend Java, to install various American export controlled policies for its cipher libs to validate the "modern' ciohersuite used in the latest windows token signing/encrypting
profiles. (you should have heard me swearing about the underlying cause of those lost hours: us duplicity over manipulating crypto, but perhaps here is not the right place to rant).<br>
<br>
Since your sp code works with adfs idp when using your own keying, perhaps compare key lengths of the public modulus: yours vs theirs.<br>
<br>
<br>
Sent from my Windows Phone</div>
</div>
<div dir="ltr">
<hr>
<span style="font-size:11pt; font-family:Calibri,sans-serif; font-weight:bold">From:
</span><span style="font-size:11pt; font-family:Calibri,sans-serif"><a href="mailto:cantor.2@osu.edu">Cantor, Scott</a></span><br>
<span style="font-size:11pt; font-family:Calibri,sans-serif; font-weight:bold">Sent:
</span><span style="font-size:11pt; font-family:Calibri,sans-serif">ý2/ý16/ý2014 9:49 AM</span><br>
<span style="font-size:11pt; font-family:Calibri,sans-serif; font-weight:bold">To:
</span><span style="font-size:11pt; font-family:Calibri,sans-serif"><a href="mailto:dev@shibboleth.net">Shib Dev</a></span><br>
<span style="font-size:11pt; font-family:Calibri,sans-serif; font-weight:bold">Subject:
</span><span style="font-size:11pt; font-family:Calibri,sans-serif">Re: ADFS :Opensaml2 Integration: Signature did not validate against the credential's key</span><br>
<br>
</div>
</div>
<font size="2"><span style="font-size:10pt;">
<div class="PlainText">On 2/15/14, 9:26 PM, "smita.sree2007@gmail.com" <smita.sree2007@gmail.com><br>
wrote:<br>
><br>
>Thanks Scott, for looking into this issue. We are not able to make sure<br>
>the key is right.<br>
<br>
Then you're going to have a very hard time.<br>
<br>
> Client tells that they use ADFS's tokensigning certificate to sign the<br>
>response and ADFS's communication certificate is the one uploaded in our<br>
>SP server. The flow works fine, if the IDP cleint uses a test certificate<br>
>given by us. So Will there be any issue with the certificate which , the<br>
>IDP client used through ADFS, If so how can we identify? Is there any way<br>
>to identify the mismatch between the signing certificate and the public<br>
>key certificate? >From the OpenSAML debug log(attached in first email<br>
>thread), I couldn't get any useful information to identify the issue?<br>
>Thanks Smitha<br>
<br>
The IdP does not validate certificates like that, not without extra work<br>
in the metadata to provide trust anchors. Either the request is corrupted,<br>
or more likely the key they gave you isn't correct. That's all I can tell<br>
you.<br>
<br>
I don't even remember anymore what the message type is here, but if it's<br>
an XML Signature, the link I gave you has what you need to proceed if you<br>
have no other information. If it's a redirect signature, that's a more<br>
complex situation for debugging.<br>
<br>
-- Scott<br>
<br>
<br>
--<br>
To unsubscribe from this list send an email to dev-unsubscribe@shibboleth.net<br>
</div>
</span></font>
</body>
</html>