Is testshib.org sending a different certificate when returning an Assertion to my SP?
Nate Klingenstein
ndk at internet2.edu
Wed Apr 17 21:34:58 EDT 2013
Yaowen,
They have the same public key:
Certificate:
Data:
Version: 3 (0x2)
Serial Number: 0 (0x0)
Signature Algorithm: sha1WithRSAEncryption
Issuer: C=US, ST=Pennsylvania, L=Pittsburgh, O=TestShib, CN=idp.testshib.org
Validity
Not Before: Aug 30 21:12:25 2006 GMT
Not After : Aug 27 21:12:25 2016 GMT
Subject: C=US, ST=Pennsylvania, L=Pittsburgh, O=TestShib, CN=idp.testshib.org
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
Public-Key: (2048 bit)
Modulus:
00:ad:89:02:1a:e4:e6:26:9f:5e:00:e4:86:1f:04:
49:a3:54:8d:6a:d0:79:64:e2:aa:0c:cf:72:b2:0e:
c2:c9:54:c3:0a:57:29:bb:dd:e0:48:fd:74:9c:7e:
20:90:26:4e:96:71:12:36:0b:6d:83:4a:fe:32:a2:
fc:b5:f2:42:eb:26:dd:74:41:41:dd:80:68:f0:f6:
5a:8c:a4:9e:dc:e4:34:d4:ec:37:c9:3e:08:f9:67:
60:d6:db:13:a5:28:1e:f6:01:33:ed:2a:c2:d3:b1:
24:62:61:ee:3e:d7:7b:d4:21:e2:51:a0:96:0e:ff:
b1:55:f5:10:5f:46:93:34:f1:66:0e:2c:73:52:3a:
18:cd:b1:83:ae:d0:32:0a:a0:3c:7f:d0:8d:da:dc:
48:7c:99:e9:1c:4e:aa:e8:29:8a:72:82:c0:0d:2e:
14:ac:d3:e5:84:74:b3:77:ad:78:91:1f:c9:62:29:
2c:d0:ae:24:6d:1a:82:40:5d:03:bf:43:f9:0e:2f:
ab:11:f7:9f:0b:a8:25:57:cc:ac:0b:c7:41:e7:ff:
67:6f:4c:a1:fe:88:d1:b8:91:a6:80:c5:87:81:69:
3a:87:48:a1:8e:28:6a:8a:ee:23:00:2a:2f:51:9e:
ef:54:e0:a0:48:4e:48:a6:7e:ce:23:0a:9d:f7:7c:
e9:db
Exponent: 65537 (0x10001)
X509v3 extensions:
X509v3 Subject Key Identifier:
AC:05:0F:3A:F6:78:7C:DC:AA:99:AF:98:C0:AE:BE:3F:ED:BF:90:6B
X509v3 Authority Key Identifier:
keyid:AC:05:0F:3A:F6:78:7C:DC:AA:99:AF:98:C0:AE:BE:3F:ED:BF:90:6B
DirName:/C=US/ST=Pennsylvania/L=Pittsburgh/O=TestShib/CN=idp.testshib.org
serial:00
X509v3 Basic Constraints:
CA:TRUE
Signature Algorithm: sha1WithRSAEncryption
8d:1d:bd:3e:1a:c2:6e:4f:2a:2c:de:4c:15:f4:95:93:df:2d:
dc:24:fd:8c:76:68:63:17:7c:40:c4:4b:23:88:fb:89:84:31:
5e:21:89:4d:3d:45:5e:cd:67:77:84:61:6b:db:a7:f8:ba:93:
7d:e3:0c:62:a2:12:74:30:c8:ea:db:fc:88:da:64:38:0b:d9:
65:4a:2c:56:45:28:f7:7a:6f:d5:3d:11:3f:3d:f9:85:c1:c7:
62:ad:b2:79:ee:7d:1c:93:9c:a3:66:c5:95:cb:07:f0:90:57:
45:24:6b:27:74:3b:12:eb:7e:cf:db:a8:f3:42:5d:18:d2:78:
fd:22:72:e5:4a:2b:67:c2:9a:cc:68:f5:ea:57:c9:84:e0:57:
95:d8:2b:86:9a:50:05:bd:0d:ab:a1:ca:1e:0b:aa:9b:04:5f:
27:e5:a4:c5:e9:99:5f:38:5e:76:20:23:19:e9:1a:f2:7c:fc:
26:3c:31:a5:48:c0:89:25:98:28:bb:49:84:61:1a:4e:a0:98:
c4:20:97:d8:3c:3e:74:e4:ea:53:31:ce:67:b5:8a:bf:82:57:
3c:ae:46:fd:48:6b:f0:af:ea:86:61:53:da:72:10:8b:9d:fc:
9f:aa:d5:60:b7:96:8f:c0:5b:9e:5f:9e:bf:4a:5e:63:3c:45:
c8:5e:6c:40
-----BEGIN CERTIFICATE-----
MIIEDjCCAvagAwIBAgIBADANBgkqhkiG9w0BAQUFADBnMQswCQYDVQQGEwJVUzEV
MBMGA1UECBMMUGVubnN5bHZhbmlhMRMwEQYDVQQHEwpQaXR0c2J1cmdoMREwDwYD
VQQKEwhUZXN0U2hpYjEZMBcGA1UEAxMQaWRwLnRlc3RzaGliLm9yZzAeFw0wNjA4
MzAyMTEyMjVaFw0xNjA4MjcyMTEyMjVaMGcxCzAJBgNVBAYTAlVTMRUwEwYDVQQI
EwxQZW5uc3lsdmFuaWExEzARBgNVBAcTClBpdHRzYnVyZ2gxETAPBgNVBAoTCFRl
c3RTaGliMRkwFwYDVQQDExBpZHAudGVzdHNoaWIub3JnMIIBIjANBgkqhkiG9w0B
AQEFAAOCAQ8AMIIBCgKCAQEArYkCGuTmJp9eAOSGHwRJo1SNatB5ZOKqDM9ysg7C
yVTDClcpu93gSP10nH4gkCZOlnESNgttg0r+MqL8tfJC6ybddEFB3YBo8PZajKSe
3OQ01Ow3yT4I+Wdg1tsTpSge9gEz7SrC07EkYmHuPtd71CHiUaCWDv+xVfUQX0aT
NPFmDixzUjoYzbGDrtAyCqA8f9CN2txIfJnpHE6q6CmKcoLADS4UrNPlhHSzd614
kR/JYiks0K4kbRqCQF0Dv0P5Di+rEfefC6glV8ysC8dB5/9nb0yh/ojRuJGmgMWH
gWk6h0ihjihqiu4jACovUZ7vVOCgSE5Ipn7OIwqd93zp2wIDAQABo4HEMIHBMB0G
A1UdDgQWBBSsBQ869nh83KqZr5jArr4/7b+QazCBkQYDVR0jBIGJMIGGgBSsBQ86
9nh83KqZr5jArr4/7b+Qa6FrpGkwZzELMAkGA1UEBhMCVVMxFTATBgNVBAgTDFBl
bm5zeWx2YW5pYTETMBEGA1UEBxMKUGl0dHNidXJnaDERMA8GA1UEChMIVGVzdFNo
aWIxGTAXBgNVBAMTEGlkcC50ZXN0c2hpYi5vcmeCAQAwDAYDVR0TBAUwAwEB/zAN
BgkqhkiG9w0BAQUFAAOCAQEAjR29PhrCbk8qLN5MFfSVk98t3CT9jHZoYxd8QMRL
I4j7iYQxXiGJTT1FXs1nd4Rha9un+LqTfeMMYqISdDDI6tv8iNpkOAvZZUosVkUo
93pv1T0RPz35hcHHYq2yee59HJOco2bFlcsH8JBXRSRrJ3Q7Eut+z9uo80JdGNJ4
/SJy5UorZ8KazGj16lfJhOBXldgrhppQBb0Nq6HKHguqmwRfJ+WkxemZXzhediAj
Geka8nz8JjwxpUjAiSWYKLtJhGEaTqCYxCCX2Dw+dOTqUzHOZ7WKv4JXPK5G/Uhr
8K/qhmFT2nIQi538n6rVYLeWj8Bbnl+ev0peYzxFyF5sQA==
-----END CERTIFICATE-----
Certificate:
Data:
Version: 3 (0x2)
Serial Number: 0 (0x0)
Signature Algorithm: sha1WithRSAEncryption
Issuer: C=US, ST=Pennsylvania, L=Pittsburgh, O=TestShib, CN=idp.testshib.org
Validity
Not Before: Aug 30 21:12:25 2006 GMT
Not After : Aug 27 21:12:25 2016 GMT
Subject: C=US, ST=Pennsylvania, L=Pittsburgh, O=TestShib, CN=idp.testshib.org
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
Public-Key: (2048 bit)
Modulus:
00:ad:89:02:1a:e4:e6:26:9f:5e:00:e4:86:1f:04:
49:a3:54:8d:6a:d0:79:64:e2:aa:0c:cf:72:b2:0e:
c2:c9:54:c3:0a:57:29:bb:dd:e0:48:fd:74:9c:7e:
20:90:26:4e:96:71:12:36:0b:6d:83:4a:fe:32:a2:
fc:b5:f2:42:eb:26:dd:74:41:41:dd:80:68:f0:f6:
5a:8c:a4:9e:dc:e4:34:d4:ec:37:c9:3e:08:f9:67:
60:d6:db:13:a5:28:1e:f6:01:33:ed:2a:c2:d3:b1:
24:62:61:ee:3e:d7:7b:d4:21:e2:51:a0:96:0e:ff:
b1:55:f5:10:5f:46:93:34:f1:66:0e:2c:73:52:3a:
18:cd:b1:83:ae:d0:32:0a:a0:3c:7f:d0:8d:da:dc:
48:7c:99:e9:1c:4e:aa:e8:29:8a:72:82:c0:0d:2e:
14:ac:d3:e5:84:74:b3:77:ad:78:91:1f:c9:62:29:
2c:d0:ae:24:6d:1a:82:40:5d:03:bf:43:f9:0e:2f:
ab:11:f7:9f:0b:a8:25:57:cc:ac:0b:c7:41:e7:ff:
67:6f:4c:a1:fe:88:d1:b8:91:a6:80:c5:87:81:69:
3a:87:48:a1:8e:28:6a:8a:ee:23:00:2a:2f:51:9e:
ef:54:e0:a0:48:4e:48:a6:7e:ce:23:0a:9d:f7:7c:
e9:db
Exponent: 65537 (0x10001)
X509v3 extensions:
X509v3 Subject Key Identifier:
AC:05:0F:3A:F6:78:7C:DC:AA:99:AF:98:C0:AE:BE:3F:ED:BF:90:6B
X509v3 Authority Key Identifier:
keyid:AC:05:0F:3A:F6:78:7C:DC:AA:99:AF:98:C0:AE:BE:3F:ED:BF:90:6B
DirName:/C=US/ST=Pennsylvania/L=Pittsburgh/O=TestShib/CN=idp.testshib.org
serial:00
X509v3 Basic Constraints:
CA:TRUE
Signature Algorithm: sha1WithRSAEncryption
8d:1d:bd:3e:1a:c2:6e:4f:2a:2c:de:4c:15:f4:95:93:df:2d:
dc:24:fd:8c:76:68:63:17:7c:40:c4:4b:23:88:fb:89:84:31:
5e:21:89:4d:3d:45:5e:cd:67:77:84:61:6b:db:a7:f8:ba:93:
7d:e3:0c:62:a2:12:74:30:c8:ea:db:fc:88:da:64:38:0b:d9:
65:4a:2c:56:45:28:f7:7a:6f:d5:3d:11:3f:3d:f9:85:c1:c7:
62:ad:b2:79:ee:7d:1c:93:9c:a3:66:c5:95:cb:07:f0:90:57:
45:24:6b:27:74:3b:12:eb:7e:cf:db:a8:f3:42:5d:18:d2:78:
fd:22:72:e5:4a:2b:67:c2:9a:cc:68:f5:ea:57:c9:84:e0:57:
95:d8:2b:86:9a:50:05:bd:0d:ab:a1:ca:1e:0b:aa:9b:04:5f:
27:e5:a4:c5:e9:99:5f:38:5e:76:20:23:19:e9:1a:f2:7c:fc:
26:3c:31:a5:48:c0:89:25:98:28:bb:49:84:61:1a:4e:a0:98:
c4:20:97:d8:3c:3e:74:e4:ea:53:31:ce:67:b5:8a:bf:82:57:
3c:ae:46:fd:48:6b:f0:af:ea:86:61:53:da:72:10:8b:9d:fc:
9f:aa:d5:60:b7:96:8f:c0:5b:9e:5f:9e:bf:4a:5e:63:3c:45:
c8:5e:6c:40
-----BEGIN CERTIFICATE-----
MIIEDjCCAvagAwIBAgIBADANBgkqhkiG9w0BAQUFADBnMQswCQYDVQQGEwJVUzEV
MBMGA1UECBMMUGVubnN5bHZhbmlhMRMwEQYDVQQHEwpQaXR0c2J1cmdoMREwDwYD
VQQKEwhUZXN0U2hpYjEZMBcGA1UEAxMQaWRwLnRlc3RzaGliLm9yZzAeFw0wNjA4
MzAyMTEyMjVaFw0xNjA4MjcyMTEyMjVaMGcxCzAJBgNVBAYTAlVTMRUwEwYDVQQI
EwxQZW5uc3lsdmFuaWExEzARBgNVBAcTClBpdHRzYnVyZ2gxETAPBgNVBAoTCFRl
c3RTaGliMRkwFwYDVQQDExBpZHAudGVzdHNoaWIub3JnMIIBIjANBgkqhkiG9w0B
AQEFAAOCAQ8AMIIBCgKCAQEArYkCGuTmJp9eAOSGHwRJo1SNatB5ZOKqDM9ysg7C
yVTDClcpu93gSP10nH4gkCZOlnESNgttg0r+MqL8tfJC6ybddEFB3YBo8PZajKSe
3OQ01Ow3yT4I+Wdg1tsTpSge9gEz7SrC07EkYmHuPtd71CHiUaCWDv+xVfUQX0aT
NPFmDixzUjoYzbGDrtAyCqA8f9CN2txIfJnpHE6q6CmKcoLADS4UrNPlhHSzd614
kR/JYiks0K4kbRqCQF0Dv0P5Di+rEfefC6glV8ysC8dB5/9nb0yh/ojRuJGmgMWH
gWk6h0ihjihqiu4jACovUZ7vVOCgSE5Ipn7OIwqd93zp2wIDAQABo4HEMIHBMB0G
A1UdDgQWBBSsBQ869nh83KqZr5jArr4/7b+QazCBkQYDVR0jBIGJMIGGgBSsBQ86
9nh83KqZr5jArr4/7b+Qa6FrpGkwZzELMAkGA1UEBhMCVVMxFTATBgNVBAgTDFBl
bm5zeWx2YW5pYTETMBEGA1UEBxMKUGl0dHNidXJnaDERMA8GA1UEChMIVGVzdFNo
aWIxGTAXBgNVBAMTEGlkcC50ZXN0c2hpYi5vcmeCAQAwDAYDVR0TBAUwAwEB/zAN
BgkqhkiG9w0BAQUFAAOCAQEAjR29PhrCbk8qLN5MFfSVk98t3CT9jHZoYxd8QMRL
I4j7iYQxXiGJTT1FXs1nd4Rha9un+LqTfeMMYqISdDDI6tv8iNpkOAvZZUosVkUo
93pv1T0RPz35hcHHYq2yee59HJOco2bFlcsH8JBXRSRrJ3Q7Eut+z9uo80JdGNJ4
/SJy5UorZ8KazGj16lfJhOBXldgrhppQBb0Nq6HKHguqmwRfJ+WkxemZXzhediAj
Geka8nz8JjwxpUjAiSWYKLtJhGEaTqCYxCCX2Dw+dOTqUzHOZ7WKv4JXPK5G/Uhr
8K/qhmFT2nIQi538n6rVYLeWj8Bbnl+ev0peYzxFyF5sQA==
-----END CERTIFICATE-----
I'm not sure why it would be using the second certificate to sign messages to you, though. It's not used in other transactions from what I can tell. It is configured into the IdP as part of an old certificate rollover.
I've commented out the certificate that I believe is leftover. You can try it again now.
On Apr 18, 2013, at 1:00 , Yaowen Tu wrote:
Scott,
Sorry about that I should have been more careful when I send out the first email.
I am trying to use certificate viewer to view the X509Certificate, and it looks like they are different:
This is the X509Certificate captured from idp metadata file:
MIIDKzCCAhOgAwIBAgIUBmArgGbiur6uu2YfHg5RCcmZWkQwDQYJKoZIhvcNAQEF
BQAwGzEZMBcGA1UEAxMQaWRwLnRlc3RzaGliLm9yZzAeFw0xMjAyMjQwMTEwMDla
Fw0zMjAyMjQwMTEwMDlaMBsxGTAXBgNVBAMTEGlkcC50ZXN0c2hpYi5vcmcwggEi
MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCUS4L8kz+wB94NmjiNh0Ff3KuB
tM2L/oeBzpQJoTALQ5HLnZdCWHRaQYD2LV2lp1zPQTBpS1aRghGrHUrBCuowq172
H9RcEk3vOb44NnVmxFCBTIbCDv6SjjLBY35QTwzcQVwWLIMq833Wt4dQKrapfwJr
p8jJd8RobpFJl0K3BbwtFTa3gBL+FDT5jYpsmld3oOLDSgUG+lqcjjVPQMgY+FC2
Jb/tyzMibd8AFUTck1TYZ8uSk44XtYfTMvz3fZYCNsympxGUVk5Qno2AoZvObSbF
unC2MSEjKQzEmdwBUJkIhV81sjC+ofH4JuImY9y7I5BA62HET5/J8/SpKV0BAgMB
AAGjZzBlMEQGA1UdEQQ9MDuCEGlkcC50ZXN0c2hpYi5vcmeGJ2h0dHBzOi8vaWRw
LnRlc3RzaGliLm9yZy9pZHAvc2hpYmJvbGV0aDAdBgNVHQ4EFgQUtEusYC7zyykK
OxNnq+L9Wo67uy8wDQYJKoZIhvcNAQEFBQADggEBABr3g1EG530HWcovEFo/3RC9
AWnD0I7zEbFZEDdMPHRdmdjpzskMF6J+Olq86qBaKL5Wn92BNIPmJvFpypokRmlo
kti7aJqvjggXNRG+6yLqBbZX4P1cK6tyT8SAZ5zwn52uw1+XFJS6HHUtPLcbnhXe
2YnXpgEE6dkx1BhEL+vKSFOeLlFiGiex3DsA5j4qpR+Za2FTbAWl0eU8H4ipMNTp
CdSxaerQTV4NMw5asLXDtRF5AMBwv2nXer+MOx2YN6t85+TCaXeQlx9svl2a5JTz
1Hayl8yhcskcx9B2O2DTQsgL0lFWeogJ2O8qoHI0eST/mCDDbnfKZ7uGuGswyws=
This is the certificate in the <Assertion> tag that return to my SP:
MIIEDjCCAvagAwIBAgIBADANBgkqhkiG9w0BAQUFADBnMQswCQYDVQQGEwJVUzEVMBMGA1UECBMM
UGVubnN5bHZhbmlhMRMwEQYDVQQHEwpQaXR0c2J1cmdoMREwDwYDVQQKEwhUZXN0U2hpYjEZMBcG
A1UEAxMQaWRwLnRlc3RzaGliLm9yZzAeFw0wNjA4MzAyMTEyMjVaFw0xNjA4MjcyMTEyMjVaMGcx
CzAJBgNVBAYTAlVTMRUwEwYDVQQIEwxQZW5uc3lsdmFuaWExEzARBgNVBAcTClBpdHRzYnVyZ2gx
ETAPBgNVBAoTCFRlc3RTaGliMRkwFwYDVQQDExBpZHAudGVzdHNoaWIub3JnMIIBIjANBgkqhkiG
9w0BAQEFAAOCAQ8AMIIBCgKCAQEArYkCGuTmJp9eAOSGHwRJo1SNatB5ZOKqDM9ysg7CyVTDClcp
u93gSP10nH4gkCZOlnESNgttg0r+MqL8tfJC6ybddEFB3YBo8PZajKSe3OQ01Ow3yT4I+Wdg1tsT
pSge9gEz7SrC07EkYmHuPtd71CHiUaCWDv+xVfUQX0aTNPFmDixzUjoYzbGDrtAyCqA8f9CN2txI
fJnpHE6q6CmKcoLADS4UrNPlhHSzd614kR/JYiks0K4kbRqCQF0Dv0P5Di+rEfefC6glV8ysC8dB
5/9nb0yh/ojRuJGmgMWHgWk6h0ihjihqiu4jACovUZ7vVOCgSE5Ipn7OIwqd93zp2wIDAQABo4HE
MIHBMB0GA1UdDgQWBBSsBQ869nh83KqZr5jArr4/7b+QazCBkQYDVR0jBIGJMIGGgBSsBQ869nh8
3KqZr5jArr4/7b+Qa6FrpGkwZzELMAkGA1UEBhMCVVMxFTATBgNVBAgTDFBlbm5zeWx2YW5pYTET
MBEGA1UEBxMKUGl0dHNidXJnaDERMA8GA1UEChMIVGVzdFNoaWIxGTAXBgNVBAMTEGlkcC50ZXN0
c2hpYi5vcmeCAQAwDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQUFAAOCAQEAjR29PhrCbk8qLN5M
FfSVk98t3CT9jHZoYxd8QMRLI4j7iYQxXiGJTT1FXs1nd4Rha9un+LqTfeMMYqISdDDI6tv8iNpk
OAvZZUosVkUo93pv1T0RPz35hcHHYq2yee59HJOco2bFlcsH8JBXRSRrJ3Q7Eut+z9uo80JdGNJ4
/SJy5UorZ8KazGj16lfJhOBXldgrhppQBb0Nq6HKHguqmwRfJ+WkxemZXzhediAjGeka8nz8Jjwx
pUjAiSWYKLtJhGEaTqCYxCCX2Dw+dOTqUzHOZ7WKv4JXPK5G/Uhr8K/qhmFT2nIQi538n6rVYLeW
Can you confirm if they are using the same key to generate the digest? I am not farmiliar with this part, if you can tell me how to do that I would be glad to do it by myself.
Thanks
Yaowen
Yaowen
On Wed, Apr 17, 2013 at 5:42 PM, Nate Klingenstein <ndk at internet2.edu<mailto:ndk at internet2.edu>> wrote:
Yaowen,
I think it's using the keypair(and certificate) as configured in metadata to sign assertions:
<ds:SignatureValue>gVi0RA0xHz3UKQIhv464B4i5hrdq88GbL5JgS5m6zUtox7zW3ttBX6gU2QDEb6oXCB/GJ1JAtqYzmjhXXP+TYyVVs+htVhty4aXABj3+0cE/cgKULzksgr42GMOmib7O6Zvy8Yp6mQu72fCSJdDvZsI3bRgq24HOY1Y6qR2rzC78ApVh7u+bnGOx9xil4pFokWGdJTf22xD1ZLYeNzVkO2dKLhK+SSruPR1sbkj6WCTDEiSW5aIxG/hPbx18LzEJBVyiiNq/ppr7OB4xe7GOa3+AJPHNdwxz6BPMXoaHbnG6ITQB1Gx2uKETeqPwW6aytC9DieddJ60zWQt7r/SSkA==</ds:SignatureValue><ds:KeyInfo><ds:X509Data><ds:X509Certificate>MIIEDjCCAvagAwIBAgIBADANBgkqhkiG9w0BAQUFADBnMQswCQYDVQQGEwJVUzEVMBMGA1UECBMM
UGVubnN5bHZhbmlhMRMwEQYDVQQHEwpQaXR0c2J1cmdoMREwDwYDVQQKEwhUZXN0U2hpYjEZMBcG
A1UEAxMQaWRwLnRlc3RzaGliLm9yZzAeFw0wNjA4MzAyMTEyMjVaFw0xNjA4MjcyMTEyMjVaMGcx
CzAJBgNVBAYTAlVTMRUwEwYDVQQIEwxQZW5uc3lsdmFuaWExEzARBgNVBAcTClBpdHRzYnVyZ2gx
ETAPBgNVBAoTCFRlc3RTaGliMRkwFwYDVQQDExBpZHAudGVzdHNoaWIub3JnMIIBIjANBgkqhkiG
9w0BAQEFAAOCAQ8AMIIBCgKCAQEArYkCGuTmJp9eAOSGHwRJo1SNatB5ZOKqDM9ysg7CyVTDClcp
u93gSP10nH4gkCZOlnESNgttg0r+MqL8tfJC6ybddEFB3YBo8PZajKSe3OQ01Ow3yT4I+Wdg1tsT
pSge9gEz7SrC07EkYmHuPtd71CHiUaCWDv+xVfUQX0aTNPFmDixzUjoYzbGDrtAyCqA8f9CN2txI
fJnpHE6q6CmKcoLADS4UrNPlhHSzd614kR/JYiks0K4kbRqCQF0Dv0P5Di+rEfefC6glV8ysC8dB
5/9nb0yh/ojRuJGmgMWHgWk6h0ihjihqiu4jACovUZ7vVOCgSE5Ipn7OIwqd93zp2wIDAQABo4HE
MIHBMB0GA1UdDgQWBBSsBQ869nh83KqZr5jArr4/7b+QazCBkQYDVR0jBIGJMIGGgBSsBQ869nh8
3KqZr5jArr4/7b+Qa6FrpGkwZzELMAkGA1UEBhMCVVMxFTATBgNVBAgTDFBlbm5zeWx2YW5pYTET
MBEGA1UEBxMKUGl0dHNidXJnaDERMA8GA1UEChMIVGVzdFNoaWIxGTAXBgNVBAMTEGlkcC50ZXN0
c2hpYi5vcmeCAQAwDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQUFAAOCAQEAjR29PhrCbk8qLN5M
FfSVk98t3CT9jHZoYxd8QMRLI4j7iYQxXiGJTT1FXs1nd4Rha9un+LqTfeMMYqISdDDI6tv8iNpk
OAvZZUosVkUo93pv1T0RPz35hcHHYq2yee59HJOco2bFlcsH8JBXRSRrJ3Q7Eut+z9uo80JdGNJ4
/SJy5UorZ8KazGj16lfJhOBXldgrhppQBb0Nq6HKHguqmwRfJ+WkxemZXzhediAjGeka8nz8Jjwx
pUjAiSWYKLtJhGEaTqCYxCCX2Dw+dOTqUzHOZ7WKv4JXPK5G/Uhr8K/qhmFT2nIQi538n6rVYLeW
j8Bbnl+ev0peYzxFyF5sQA==</ds:X509Certificate></ds:X509Data></ds:KeyInfo></ds:Signature><saml2:Subject><saml2:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient" NameQualifier="https://idp.testshib.org/idp/shibboleth" SPNameQualifier="https://sp.testshib.org/shibboleth-sp">_4639f7dc6610a693820b8bcbf9123f20</saml2:NameID><saml2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
<ds:KeyInfo>
<ds:X509Data>
<ds:X509Certificate>
MIIEDjCCAvagAwIBAgIBADANBgkqhkiG9w0BAQUFADBnMQswCQYDVQQGEwJVUzEV
MBMGA1UECBMMUGVubnN5bHZhbmlhMRMwEQYDVQQHEwpQaXR0c2J1cmdoMREwDwYD
VQQKEwhUZXN0U2hpYjEZMBcGA1UEAxMQaWRwLnRlc3RzaGliLm9yZzAeFw0wNjA4
MzAyMTEyMjVaFw0xNjA4MjcyMTEyMjVaMGcxCzAJBgNVBAYTAlVTMRUwEwYDVQQI
EwxQZW5uc3lsdmFuaWExEzARBgNVBAcTClBpdHRzYnVyZ2gxETAPBgNVBAoTCFRl
c3RTaGliMRkwFwYDVQQDExBpZHAudGVzdHNoaWIub3JnMIIBIjANBgkqhkiG9w0B
AQEFAAOCAQ8AMIIBCgKCAQEArYkCGuTmJp9eAOSGHwRJo1SNatB5ZOKqDM9ysg7C
yVTDClcpu93gSP10nH4gkCZOlnESNgttg0r+MqL8tfJC6ybddEFB3YBo8PZajKSe
3OQ01Ow3yT4I+Wdg1tsTpSge9gEz7SrC07EkYmHuPtd71CHiUaCWDv+xVfUQX0aT
NPFmDixzUjoYzbGDrtAyCqA8f9CN2txIfJnpHE6q6CmKcoLADS4UrNPlhHSzd614
kR/JYiks0K4kbRqCQF0Dv0P5Di+rEfefC6glV8ysC8dB5/9nb0yh/ojRuJGmgMWH
gWk6h0ihjihqiu4jACovUZ7vVOCgSE5Ipn7OIwqd93zp2wIDAQABo4HEMIHBMB0G
A1UdDgQWBBSsBQ869nh83KqZr5jArr4/7b+QazCBkQYDVR0jBIGJMIGGgBSsBQ86
9nh83KqZr5jArr4/7b+Qa6FrpGkwZzELMAkGA1UEBhMCVVMxFTATBgNVBAgTDFBl
bm5zeWx2YW5pYTETMBEGA1UEBxMKUGl0dHNidXJnaDERMA8GA1UEChMIVGVzdFNo
aWIxGTAXBgNVBAMTEGlkcC50ZXN0c2hpYi5vcmeCAQAwDAYDVR0TBAUwAwEB/zAN
BgkqhkiG9w0BAQUFAAOCAQEAjR29PhrCbk8qLN5MFfSVk98t3CT9jHZoYxd8QMRL
I4j7iYQxXiGJTT1FXs1nd4Rha9un+LqTfeMMYqISdDDI6tv8iNpkOAvZZUosVkUo
93pv1T0RPz35hcHHYq2yee59HJOco2bFlcsH8JBXRSRrJ3Q7Eut+z9uo80JdGNJ4
/SJy5UorZ8KazGj16lfJhOBXldgrhppQBb0Nq6HKHguqmwRfJ+WkxemZXzhediAj
Geka8nz8JjwxpUjAiSWYKLtJhGEaTqCYxCCX2Dw+dOTqUzHOZ7WKv4JXPK5G/Uhr
8K/qhmFT2nIQi538n6rVYLeWj8Bbnl+ev0peYzxFyF5sQA==
</ds:X509Certificate>
</ds:X509Data>
</ds:KeyInfo>
You might be looking at the encryption key, which corresponds to the SP and also matches metadata.
Thanks,
Nate.
On Apr 18, 2013, at 0:15 , Yaowen Tu wrote:
> Actually I meant that the Assertion is signed. It looks like testshib.org<http://testshib.org/> is using a different certificate to sign the assertion.
>
> Thanks,
> Yaowen
>
> Yaowen
>
>
> On Wed, Apr 17, 2013 at 5:08 PM, Yaowen Tu <yaowen.tu at gmail.com<mailto:yaowen.tu at gmail.com>> wrote:
> But the response returned to my SP is signed. In the Assertion object, the isSigned() flag is true.
>
> Did I miss anything?
>
> Thanks,
> Yaowen
>
> Yaowen
>
>
> On Wed, Apr 17, 2013 at 4:48 PM, Cantor, Scott <cantor.2 at osu.edu<mailto:cantor.2 at osu.edu>> wrote:
> On 4/17/13 7:35 PM, "Yaowen Tu" <yaowen.tu at gmail.com<mailto:yaowen.tu at gmail.com>> wrote:
> >
> >From the SAMLResponse of the testshib.org<http://testshib.org/> <http://testshib.org<http://testshib.org/>> IdP, it
> >contains a different certificate in the <Response> tag.
>
> I just looked at a response from it. Since it's not signing the response,
> there is no certificate in it. So I would guess that given nothing would
> have changed, that you are probably mistaken about the issue.
>
> -- Scott
>
>
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net<mailto:users-unsubscribe at shibboleth.net>
>
>
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net<mailto:users-unsubscribe at shibboleth.net>
--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net<mailto:users-unsubscribe at shibboleth.net>
--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net<mailto:users-unsubscribe at shibboleth.net>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130418/56910bf8/attachment-0001.html
More information about the users
mailing list