help signing metadata

[Jonathan Bricker]

I'm having trouble getting my SP to accept signed metadata from my IDP.  I'm trying to do a similar set up as SWITCH in regards to the Metadata filter.   The error I get is : filtering out group at root of instance after failed signature check: Root metadata element was unsigned. The metadata file for the sp is built from a composite of metadata from a DB.  I removed all but my signed metadata.  When the error says root element was not signed does it want the <EntitiesDescriptor> signed as well as each <EntityDescriptor>?


Here is the filter
<MetadataProvider type="XML" uri="http://localhost:8080/saml-metadata/smd"
                backingFilePath="saml-metadata.xml" reloadInterval="60">
                <MetadataFilter type="Signature" verifyName="false">
                                <TrustEngine type="StaticPKIX" verifyDepth="5">
                                                <CredentialResolver type="File">
                                                                <Certificate format="PKCS12" password="somepassword ">
                                                                                <Path>/etc/shibboleth/credentials/ec2.idp.amazonaws.com.pfx</Path>
                                                                </Certificate>
                                                </CredentialResolver>
                                </TrustEngine>
                </MetadataFilter>
</MetadataProvider>
I used XmlSecTool to sign the IDP metadata.  The certificate CN matches the entityID in the metadata.
<EntityDescriptor entityID="ec2.idp.amazonaws.com">

thanks

Jonathan Bricker
Senior Software Engineer
ExactTarget
Office  |  317.524.2789
Mobile  |  317.435.0763
U.S. Technical Support | 866.558.9823
International Technical Support | +1.317.275.5483
Email l jbricker at exacttarget.com<mailto:jsmith at exacttarget.com>

[cid:image001.gif at 01CC92FA.77AABFE0]<http://email.exacttarget.com/hub/index.html>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20111025/771112b8/attachment-0001.html 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image001.gif
Type: image/gif
Size: 11913 bytes
Desc: image001.gif
Url : http://shibboleth.net/pipermail/users/attachments/20111025/771112b8/attachment-0001.gif