SP Signature Issue

[Natarajan, Senthil]

Hi,

I am trying to setup local SP and talk to just one local Idp.



Everything seems work except the final step that SP couldn't read the SAML assertion from Idp due to Signature problem.





And I am getting this error

2011-10-04 16:30:04 ERROR XMLTooling.TrustEngine.PKIX [4]: certificate name was not acceptable

2011-10-04 16:30:04 ERROR OpenSAML.SecurityPolicyRule.XMLSigning [4]: unable to verify message signature with supplied trust engine

2011-10-04 16:30:32 ERROR XMLTooling.TrustEngine.PKIX [5]: certificate name was not acceptable

2011-10-04 16:30:32 ERROR OpenSAML.SecurityPolicyRule.XMLSigning [5]: unable to verify message signature with supplied trust engine

2011-10-04 16:31:32 ERROR XMLTooling.TrustEngine.PKIX [3]: certificate name was not acceptable

2011-10-04 16:31:32 ERROR OpenSAML.SecurityPolicyRule.XMLSigning [3]: unable to verify message signature with supplied trust engine

2011-10-04 16:42:17 INFO XMLTooling.StorageService : purged 6 expired record(s) from storage

2011-10-04 16:56:12 ERROR XMLTooling.TrustEngine.PKIX [7]: certificate name was not acceptable

2011-10-04 16:56:12 ERROR OpenSAML.SecurityPolicyRule.XMLSigning [7]: unable to verify message signature with supplied trust engine

2011-10-04 17:12:17 INFO XMLTooling.StorageService : purged 2 expired record(s) from storage

2011-10-05 08:50:32 ERROR XMLTooling.TrustEngine.PKIX [5]: certificate name was not acceptable







I have following in shibboleth2.xml for Idp metadata, and the file has certificate embedded in it.

<MetadataProvider type="XML" file="idp-metadata.xml" path="idp-metadata.xml">

</MetadataProvider>



Do I need to copy the root CA certificate or something from Idp to SP and need to configure in shibboleth2.xml? (Both SP and Idp certificates are self-signed)



Could you please provide some pointer to fix this signature issue?



Thanks,

Senthil

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20111005/9519eea5/attachment.html