Failure to validate Response Signature

[Rainer Hoerbe]

I agree. But how can that happen if the issuer matches the entityID in metadata and there is no difference in the certificates in response and metadata?

Peter suggested to make an explicit configuration of the explicit trust engine to produce more messages. BTW, the wiki explains elements and attributes, but does not provide an example.

- Rainer

Am 04.10.2012 um 16:44 schrieb "Cantor, Scott" <cantor.2 at osu.edu>:

> On 10/4/12 4:44 AM, "Rainer Hoerbe" <rainer at hoerbe.at> wrote:
> 
>> I am using the default security policy in a SP 2.5 configuration. The
>> IdP's metadata contains the certificate, a diff on the values of
>> <ds:X509Certificate> in response and metadata does not show any
>> difference. Yet the SP complains:
>> ERROR XMLTooling.TrustEngine.PKIX [2]: certificate name was not acceptable
>> ERROR OpenSAML.SecurityPolicyRule.XMLSigning [2]: unable to verify
>> message signature with supplied trust engine
>> 
>> In my understanding the explicit trust engine is first, and PKIX is
>> second. I do not understand the second error message.
> 
> The second message means that it failed to match the signature key with
> the key in the metadata you gave it, so it fell through and then you
> usually end up with that kind of message if the intended trust model was
> the initial one.
> 
> -- Scott
> 
> 
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net