Decoding encrypted attributes from an IDP

[Nate Klingenstein]

Rob,

This error typically occurs when the certificate in their metadata is different from the certificate used to encrypt the assertion(will be in the DEBUG log). Can you compare the two to doublecheck?

Thanks,
Nate.

Semt frim mt iPone

On Jul 23, 2012, at 14:14, Rob Whitener <rob.whitener at audaxhealth.com> wrote:

> At Scott Cantor's suggestion, I asked our partner to encrypt the whole assertion, rather than just the attributes (they took it upon themselves to have the attributes remain encrypted as well, inside the already encrypted assertion? Seems like too much encryption to me).
> 
> Now, we are seeing errors like this in Syslog:
> 
> Jul 23 19:18:21 ip-10-90-230-192 shibboleth-sp: 1343071101 ERROR Shibboleth.Listener [24585] shib_check_user: remoted message returned an error: A valid authentication statement was not found in the incoming message.
> 
> And this in shibd.log:
> 2012-07-23 19:19:33 DEBUG XMLTooling.CredentialCriteria [16]: key algorithm didn't match ('AES' != 'RSA')
> 
> Is this something I can modify in our config?  I am certain that their metadata told us they would be using RSA, and since those are two completely different encryption modes, it seems like this might be more them than us?
> 
> Thanks,
> 
> Rob
> 
> On Fri, Jul 20, 2012 at 3:59 PM, Rob Whitener <rob.whitener at audaxhealth.com> wrote:
> Yeah, I'm not blind, and just to double check I have looked through these logs several times and uncommented all the logging options.  I am surprised that it would ignore the EcryptedAttribute element, since the docs specifically mention it:
> 
> https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPAttributeExtractor
> 
> I am on 2.3, so maybe that is the issue.
> 
> Rob
> 
> 
> On Fri, Jul 20, 2012 at 3:56 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:
> On 7/20/12 3:53 PM, "Rob Whitener" <rob.whitener at audaxhealth.com> wrote:
> >
> >Ah, got it, I misunderstood.
> 
> Code-wise, I also can verify that if it's not outright buggy and ignoring
> the element, the extractor will dump the decrypted XML on DEBUG, so that's
> all that should be needed to spot it doing that, or reporting an error.
> That strongly suggests to me it might be buggy or you're blind, and I
> doubt you're blind.
> 
> -- Scott
> 
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
> 
> 
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20120723/7eeab030/attachment.html