Is testshib.org sending a different certificate when returning an Assertion to my SP?

Wed Apr 17 21:52:51 EDT 2013

Wait, I compared the wrong certificates.  These two are obviously identical.  base64 makes my head spin.

The first certificate you pasted doesn't match any certificate that was configured into the IdP.  Here are those two:

You appear to be using the IdP's auto-generated metadata file(https://idp.testshib.org/idp/profile/Metadata/SAML) which was never updated with actual keys nor used in any documentation that I know of.  The documentation all points to a different file (https://www.testshib.org/metadata/testshib-providers.xml).

Did you find this in any documentation that we maintain?

Nevertheless, I've updated the IdP's metadata handler to point to testshib-providers.xml.

I've left the other credential pair commented out because it was just cruft.

On Apr 18, 2013, at 1:34 , Nate Klingenstein wrote:

Yaowen,

They have the same public key:

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 0 (0x0)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=US, ST=Pennsylvania, L=Pittsburgh, O=TestShib, CN=idp.testshib.org
        Validity
            Not Before: Aug 30 21:12:25 2006 GMT
            Not After : Aug 27 21:12:25 2016 GMT
        Subject: C=US, ST=Pennsylvania, L=Pittsburgh, O=TestShib, CN=idp.testshib.org
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:
                    00:ad:89:02:1a:e4:e6:26:9f:5e:00:e4:86:1f:04:
                    49:a3:54:8d:6a:d0:79:64:e2:aa:0c:cf:72:b2:0e:
                    c2:c9:54:c3:0a:57:29:bb:dd:e0:48:fd:74:9c:7e:
                    20:90:26:4e:96:71:12:36:0b:6d:83:4a:fe:32:a2:
                    fc:b5:f2:42:eb:26:dd:74:41:41:dd:80:68:f0:f6:
                    5a:8c:a4:9e:dc:e4:34:d4:ec:37:c9:3e:08:f9:67:
                    60:d6:db:13:a5:28:1e:f6:01:33:ed:2a:c2:d3:b1:
                    24:62:61:ee:3e:d7:7b:d4:21:e2:51:a0:96:0e:ff:
                    b1:55:f5:10:5f:46:93:34:f1:66:0e:2c:73:52:3a:
                    18:cd:b1:83:ae:d0:32:0a:a0:3c:7f:d0:8d:da:dc:
                    48:7c:99:e9:1c:4e:aa:e8:29:8a:72:82:c0:0d:2e:
                    14:ac:d3:e5:84:74:b3:77:ad:78:91:1f:c9:62:29:
                    2c:d0:ae:24:6d:1a:82:40:5d:03:bf:43:f9:0e:2f:
                    ab:11:f7:9f:0b:a8:25:57:cc:ac:0b:c7:41:e7:ff:
                    67:6f:4c:a1:fe:88:d1:b8:91:a6:80:c5:87:81:69:
                    3a:87:48:a1:8e:28:6a:8a:ee:23:00:2a:2f:51:9e:
                    ef:54:e0:a0:48:4e:48:a6:7e:ce:23:0a:9d:f7:7c:
                    e9:db
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                AC:05:0F:3A:F6:78:7C:DC:AA:99:AF:98:C0:AE:BE:3F:ED:BF:90:6B
            X509v3 Authority Key Identifier:
                keyid:AC:05:0F:3A:F6:78:7C:DC:AA:99:AF:98:C0:AE:BE:3F:ED:BF:90:6B
                DirName:/C=US/ST=Pennsylvania/L=Pittsburgh/O=TestShib/CN=idp.testshib.org
                serial:00

            X509v3 Basic Constraints:
                CA:TRUE
    Signature Algorithm: sha1WithRSAEncryption
        8d:1d:bd:3e:1a:c2:6e:4f:2a:2c:de:4c:15:f4:95:93:df:2d:
        dc:24:fd:8c:76:68:63:17:7c:40:c4:4b:23:88:fb:89:84:31:
        5e:21:89:4d:3d:45:5e:cd:67:77:84:61:6b:db:a7:f8:ba:93:
        7d:e3:0c:62:a2:12:74:30:c8:ea:db:fc:88:da:64:38:0b:d9:
        65:4a:2c:56:45:28:f7:7a:6f:d5:3d:11:3f:3d:f9:85:c1:c7:
        62:ad:b2:79:ee:7d:1c:93:9c:a3:66:c5:95:cb:07:f0:90:57:
        45:24:6b:27:74:3b:12:eb:7e:cf:db:a8:f3:42:5d:18:d2:78:
        fd:22:72:e5:4a:2b:67:c2:9a:cc:68:f5:ea:57:c9:84:e0:57:
        95:d8:2b:86:9a:50:05:bd:0d:ab:a1:ca:1e:0b:aa:9b:04:5f:
        27:e5:a4:c5:e9:99:5f:38:5e:76:20:23:19:e9:1a:f2:7c:fc:
        26:3c:31:a5:48:c0:89:25:98:28:bb:49:84:61:1a:4e:a0:98:
        c4:20:97:d8:3c:3e:74:e4:ea:53:31:ce:67:b5:8a:bf:82:57:
        3c:ae:46:fd:48:6b:f0:af:ea:86:61:53:da:72:10:8b:9d:fc:
        9f:aa:d5:60:b7:96:8f:c0:5b:9e:5f:9e:bf:4a:5e:63:3c:45:
        c8:5e:6c:40
-----BEGIN CERTIFICATE-----
MIIEDjCCAvagAwIBAgIBADANBgkqhkiG9w0BAQUFADBnMQswCQYDVQQGEwJVUzEV
MBMGA1UECBMMUGVubnN5bHZhbmlhMRMwEQYDVQQHEwpQaXR0c2J1cmdoMREwDwYD
VQQKEwhUZXN0U2hpYjEZMBcGA1UEAxMQaWRwLnRlc3RzaGliLm9yZzAeFw0wNjA4
MzAyMTEyMjVaFw0xNjA4MjcyMTEyMjVaMGcxCzAJBgNVBAYTAlVTMRUwEwYDVQQI
EwxQZW5uc3lsdmFuaWExEzARBgNVBAcTClBpdHRzYnVyZ2gxETAPBgNVBAoTCFRl
c3RTaGliMRkwFwYDVQQDExBpZHAudGVzdHNoaWIub3JnMIIBIjANBgkqhkiG9w0B
AQEFAAOCAQ8AMIIBCgKCAQEArYkCGuTmJp9eAOSGHwRJo1SNatB5ZOKqDM9ysg7C
yVTDClcpu93gSP10nH4gkCZOlnESNgttg0r+MqL8tfJC6ybddEFB3YBo8PZajKSe
3OQ01Ow3yT4I+Wdg1tsTpSge9gEz7SrC07EkYmHuPtd71CHiUaCWDv+xVfUQX0aT
NPFmDixzUjoYzbGDrtAyCqA8f9CN2txIfJnpHE6q6CmKcoLADS4UrNPlhHSzd614
kR/JYiks0K4kbRqCQF0Dv0P5Di+rEfefC6glV8ysC8dB5/9nb0yh/ojRuJGmgMWH
gWk6h0ihjihqiu4jACovUZ7vVOCgSE5Ipn7OIwqd93zp2wIDAQABo4HEMIHBMB0G
A1UdDgQWBBSsBQ869nh83KqZr5jArr4/7b+QazCBkQYDVR0jBIGJMIGGgBSsBQ86
9nh83KqZr5jArr4/7b+Qa6FrpGkwZzELMAkGA1UEBhMCVVMxFTATBgNVBAgTDFBl
bm5zeWx2YW5pYTETMBEGA1UEBxMKUGl0dHNidXJnaDERMA8GA1UEChMIVGVzdFNo
aWIxGTAXBgNVBAMTEGlkcC50ZXN0c2hpYi5vcmeCAQAwDAYDVR0TBAUwAwEB/zAN
BgkqhkiG9w0BAQUFAAOCAQEAjR29PhrCbk8qLN5MFfSVk98t3CT9jHZoYxd8QMRL
I4j7iYQxXiGJTT1FXs1nd4Rha9un+LqTfeMMYqISdDDI6tv8iNpkOAvZZUosVkUo
93pv1T0RPz35hcHHYq2yee59HJOco2bFlcsH8JBXRSRrJ3Q7Eut+z9uo80JdGNJ4
/SJy5UorZ8KazGj16lfJhOBXldgrhppQBb0Nq6HKHguqmwRfJ+WkxemZXzhediAj
Geka8nz8JjwxpUjAiSWYKLtJhGEaTqCYxCCX2Dw+dOTqUzHOZ7WKv4JXPK5G/Uhr
8K/qhmFT2nIQi538n6rVYLeWj8Bbnl+ev0peYzxFyF5sQA==
-----END CERTIFICATE-----

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 0 (0x0)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=US, ST=Pennsylvania, L=Pittsburgh, O=TestShib, CN=idp.testshib.org
        Validity
            Not Before: Aug 30 21:12:25 2006 GMT
            Not After : Aug 27 21:12:25 2016 GMT
        Subject: C=US, ST=Pennsylvania, L=Pittsburgh, O=TestShib, CN=idp.testshib.org
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:
                    00:ad:89:02:1a:e4:e6:26:9f:5e:00:e4:86:1f:04:
                    49:a3:54:8d:6a:d0:79:64:e2:aa:0c:cf:72:b2:0e:
                    c2:c9:54:c3:0a:57:29:bb:dd:e0:48:fd:74:9c:7e:
                    20:90:26:4e:96:71:12:36:0b:6d:83:4a:fe:32:a2:
                    fc:b5:f2:42:eb:26:dd:74:41:41:dd:80:68:f0:f6:
                    5a:8c:a4:9e:dc:e4:34:d4:ec:37:c9:3e:08:f9:67:
                    60:d6:db:13:a5:28:1e:f6:01:33:ed:2a:c2:d3:b1:
                    24:62:61:ee:3e:d7:7b:d4:21:e2:51:a0:96:0e:ff:
                    b1:55:f5:10:5f:46:93:34:f1:66:0e:2c:73:52:3a:
                    18:cd:b1:83:ae:d0:32:0a:a0:3c:7f:d0:8d:da:dc:
                    48:7c:99:e9:1c:4e:aa:e8:29:8a:72:82:c0:0d:2e:
                    14:ac:d3:e5:84:74:b3:77:ad:78:91:1f:c9:62:29:
                    2c:d0:ae:24:6d:1a:82:40:5d:03:bf:43:f9:0e:2f:
                    ab:11:f7:9f:0b:a8:25:57:cc:ac:0b:c7:41:e7:ff:
                    67:6f:4c:a1:fe:88:d1:b8:91:a6:80:c5:87:81:69:
                    3a:87:48:a1:8e:28:6a:8a:ee:23:00:2a:2f:51:9e:
                    ef:54:e0:a0:48:4e:48:a6:7e:ce:23:0a:9d:f7:7c:
                    e9:db
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                AC:05:0F:3A:F6:78:7C:DC:AA:99:AF:98:C0:AE:BE:3F:ED:BF:90:6B
            X509v3 Authority Key Identifier:
                keyid:AC:05:0F:3A:F6:78:7C:DC:AA:99:AF:98:C0:AE:BE:3F:ED:BF:90:6B
                DirName:/C=US/ST=Pennsylvania/L=Pittsburgh/O=TestShib/CN=idp.testshib.org
                serial:00

            X509v3 Basic Constraints:
                CA:TRUE
    Signature Algorithm: sha1WithRSAEncryption
        8d:1d:bd:3e:1a:c2:6e:4f:2a:2c:de:4c:15:f4:95:93:df:2d:
        dc:24:fd:8c:76:68:63:17:7c:40:c4:4b:23:88:fb:89:84:31:
        5e:21:89:4d:3d:45:5e:cd:67:77:84:61:6b:db:a7:f8:ba:93:
        7d:e3:0c:62:a2:12:74:30:c8:ea:db:fc:88:da:64:38:0b:d9:
        65:4a:2c:56:45:28:f7:7a:6f:d5:3d:11:3f:3d:f9:85:c1:c7:
        62:ad:b2:79:ee:7d:1c:93:9c:a3:66:c5:95:cb:07:f0:90:57:
        45:24:6b:27:74:3b:12:eb:7e:cf:db:a8:f3:42:5d:18:d2:78:
        fd:22:72:e5:4a:2b:67:c2:9a:cc:68:f5:ea:57:c9:84:e0:57:
        95:d8:2b:86:9a:50:05:bd:0d:ab:a1:ca:1e:0b:aa:9b:04:5f:
        27:e5:a4:c5:e9:99:5f:38:5e:76:20:23:19:e9:1a:f2:7c:fc:
        26:3c:31:a5:48:c0:89:25:98:28:bb:49:84:61:1a:4e:a0:98:
        c4:20:97:d8:3c:3e:74:e4:ea:53:31:ce:67:b5:8a:bf:82:57:
        3c:ae:46:fd:48:6b:f0:af:ea:86:61:53:da:72:10:8b:9d:fc:
        9f:aa:d5:60:b7:96:8f:c0:5b:9e:5f:9e:bf:4a:5e:63:3c:45:
        c8:5e:6c:40
-----BEGIN CERTIFICATE-----
MIIEDjCCAvagAwIBAgIBADANBgkqhkiG9w0BAQUFADBnMQswCQYDVQQGEwJVUzEV
MBMGA1UECBMMUGVubnN5bHZhbmlhMRMwEQYDVQQHEwpQaXR0c2J1cmdoMREwDwYD
VQQKEwhUZXN0U2hpYjEZMBcGA1UEAxMQaWRwLnRlc3RzaGliLm9yZzAeFw0wNjA4
MzAyMTEyMjVaFw0xNjA4MjcyMTEyMjVaMGcxCzAJBgNVBAYTAlVTMRUwEwYDVQQI
EwxQZW5uc3lsdmFuaWExEzARBgNVBAcTClBpdHRzYnVyZ2gxETAPBgNVBAoTCFRl
c3RTaGliMRkwFwYDVQQDExBpZHAudGVzdHNoaWIub3JnMIIBIjANBgkqhkiG9w0B
AQEFAAOCAQ8AMIIBCgKCAQEArYkCGuTmJp9eAOSGHwRJo1SNatB5ZOKqDM9ysg7C
yVTDClcpu93gSP10nH4gkCZOlnESNgttg0r+MqL8tfJC6ybddEFB3YBo8PZajKSe
3OQ01Ow3yT4I+Wdg1tsTpSge9gEz7SrC07EkYmHuPtd71CHiUaCWDv+xVfUQX0aT
NPFmDixzUjoYzbGDrtAyCqA8f9CN2txIfJnpHE6q6CmKcoLADS4UrNPlhHSzd614
kR/JYiks0K4kbRqCQF0Dv0P5Di+rEfefC6glV8ysC8dB5/9nb0yh/ojRuJGmgMWH
gWk6h0ihjihqiu4jACovUZ7vVOCgSE5Ipn7OIwqd93zp2wIDAQABo4HEMIHBMB0G
A1UdDgQWBBSsBQ869nh83KqZr5jArr4/7b+QazCBkQYDVR0jBIGJMIGGgBSsBQ86
9nh83KqZr5jArr4/7b+Qa6FrpGkwZzELMAkGA1UEBhMCVVMxFTATBgNVBAgTDFBl
bm5zeWx2YW5pYTETMBEGA1UEBxMKUGl0dHNidXJnaDERMA8GA1UEChMIVGVzdFNo
aWIxGTAXBgNVBAMTEGlkcC50ZXN0c2hpYi5vcmeCAQAwDAYDVR0TBAUwAwEB/zAN
BgkqhkiG9w0BAQUFAAOCAQEAjR29PhrCbk8qLN5MFfSVk98t3CT9jHZoYxd8QMRL
I4j7iYQxXiGJTT1FXs1nd4Rha9un+LqTfeMMYqISdDDI6tv8iNpkOAvZZUosVkUo
93pv1T0RPz35hcHHYq2yee59HJOco2bFlcsH8JBXRSRrJ3Q7Eut+z9uo80JdGNJ4
/SJy5UorZ8KazGj16lfJhOBXldgrhppQBb0Nq6HKHguqmwRfJ+WkxemZXzhediAj
Geka8nz8JjwxpUjAiSWYKLtJhGEaTqCYxCCX2Dw+dOTqUzHOZ7WKv4JXPK5G/Uhr
8K/qhmFT2nIQi538n6rVYLeWj8Bbnl+ev0peYzxFyF5sQA==
-----END CERTIFICATE-----

I'm not sure why it would be using the second certificate to sign messages to you, though.  It's not used in other transactions from what I can tell.  It is configured into the IdP as part of an old certificate rollover.

I've commented out the certificate that I believe is leftover.  You can try it again now.

On Apr 18, 2013, at 1:00 , Yaowen Tu wrote:

Scott,

Sorry about that I should have been more careful when I send out the first email.

I am trying to use certificate viewer to view the X509Certificate, and it looks like they are different:

This is the X509Certificate captured from idp metadata file:
MIIDKzCCAhOgAwIBAgIUBmArgGbiur6uu2YfHg5RCcmZWkQwDQYJKoZIhvcNAQEF
BQAwGzEZMBcGA1UEAxMQaWRwLnRlc3RzaGliLm9yZzAeFw0xMjAyMjQwMTEwMDla
Fw0zMjAyMjQwMTEwMDlaMBsxGTAXBgNVBAMTEGlkcC50ZXN0c2hpYi5vcmcwggEi
MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCUS4L8kz+wB94NmjiNh0Ff3KuB
tM2L/oeBzpQJoTALQ5HLnZdCWHRaQYD2LV2lp1zPQTBpS1aRghGrHUrBCuowq172
H9RcEk3vOb44NnVmxFCBTIbCDv6SjjLBY35QTwzcQVwWLIMq833Wt4dQKrapfwJr
p8jJd8RobpFJl0K3BbwtFTa3gBL+FDT5jYpsmld3oOLDSgUG+lqcjjVPQMgY+FC2
Jb/tyzMibd8AFUTck1TYZ8uSk44XtYfTMvz3fZYCNsympxGUVk5Qno2AoZvObSbF
unC2MSEjKQzEmdwBUJkIhV81sjC+ofH4JuImY9y7I5BA62HET5/J8/SpKV0BAgMB
AAGjZzBlMEQGA1UdEQQ9MDuCEGlkcC50ZXN0c2hpYi5vcmeGJ2h0dHBzOi8vaWRw
LnRlc3RzaGliLm9yZy9pZHAvc2hpYmJvbGV0aDAdBgNVHQ4EFgQUtEusYC7zyykK
OxNnq+L9Wo67uy8wDQYJKoZIhvcNAQEFBQADggEBABr3g1EG530HWcovEFo/3RC9
AWnD0I7zEbFZEDdMPHRdmdjpzskMF6J+Olq86qBaKL5Wn92BNIPmJvFpypokRmlo
kti7aJqvjggXNRG+6yLqBbZX4P1cK6tyT8SAZ5zwn52uw1+XFJS6HHUtPLcbnhXe
2YnXpgEE6dkx1BhEL+vKSFOeLlFiGiex3DsA5j4qpR+Za2FTbAWl0eU8H4ipMNTp
CdSxaerQTV4NMw5asLXDtRF5AMBwv2nXer+MOx2YN6t85+TCaXeQlx9svl2a5JTz
1Hayl8yhcskcx9B2O2DTQsgL0lFWeogJ2O8qoHI0eST/mCDDbnfKZ7uGuGswyws=

This is the certificate in the <Assertion> tag that return to my SP:
MIIEDjCCAvagAwIBAgIBADANBgkqhkiG9w0BAQUFADBnMQswCQYDVQQGEwJVUzEVMBMGA1UECBMM
UGVubnN5bHZhbmlhMRMwEQYDVQQHEwpQaXR0c2J1cmdoMREwDwYDVQQKEwhUZXN0U2hpYjEZMBcG
A1UEAxMQaWRwLnRlc3RzaGliLm9yZzAeFw0wNjA4MzAyMTEyMjVaFw0xNjA4MjcyMTEyMjVaMGcx
CzAJBgNVBAYTAlVTMRUwEwYDVQQIEwxQZW5uc3lsdmFuaWExEzARBgNVBAcTClBpdHRzYnVyZ2gx
ETAPBgNVBAoTCFRlc3RTaGliMRkwFwYDVQQDExBpZHAudGVzdHNoaWIub3JnMIIBIjANBgkqhkiG
9w0BAQEFAAOCAQ8AMIIBCgKCAQEArYkCGuTmJp9eAOSGHwRJo1SNatB5ZOKqDM9ysg7CyVTDClcp
u93gSP10nH4gkCZOlnESNgttg0r+MqL8tfJC6ybddEFB3YBo8PZajKSe3OQ01Ow3yT4I+Wdg1tsT
pSge9gEz7SrC07EkYmHuPtd71CHiUaCWDv+xVfUQX0aTNPFmDixzUjoYzbGDrtAyCqA8f9CN2txI
fJnpHE6q6CmKcoLADS4UrNPlhHSzd614kR/JYiks0K4kbRqCQF0Dv0P5Di+rEfefC6glV8ysC8dB
5/9nb0yh/ojRuJGmgMWHgWk6h0ihjihqiu4jACovUZ7vVOCgSE5Ipn7OIwqd93zp2wIDAQABo4HE
MIHBMB0GA1UdDgQWBBSsBQ869nh83KqZr5jArr4/7b+QazCBkQYDVR0jBIGJMIGGgBSsBQ869nh8
3KqZr5jArr4/7b+Qa6FrpGkwZzELMAkGA1UEBhMCVVMxFTATBgNVBAgTDFBlbm5zeWx2YW5pYTET
MBEGA1UEBxMKUGl0dHNidXJnaDERMA8GA1UEChMIVGVzdFNoaWIxGTAXBgNVBAMTEGlkcC50ZXN0
c2hpYi5vcmeCAQAwDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQUFAAOCAQEAjR29PhrCbk8qLN5M
FfSVk98t3CT9jHZoYxd8QMRLI4j7iYQxXiGJTT1FXs1nd4Rha9un+LqTfeMMYqISdDDI6tv8iNpk
OAvZZUosVkUo93pv1T0RPz35hcHHYq2yee59HJOco2bFlcsH8JBXRSRrJ3Q7Eut+z9uo80JdGNJ4
/SJy5UorZ8KazGj16lfJhOBXldgrhppQBb0Nq6HKHguqmwRfJ+WkxemZXzhediAjGeka8nz8Jjwx
pUjAiSWYKLtJhGEaTqCYxCCX2Dw+dOTqUzHOZ7WKv4JXPK5G/Uhr8K/qhmFT2nIQi538n6rVYLeW

Can you confirm if they are using the same key to generate the digest? I am not farmiliar with this part, if you can tell me how to do that I would be glad to do it by myself.

Thanks
Yaowen

Yaowen

On Wed, Apr 17, 2013 at 5:42 PM, Nate Klingenstein <ndk at internet2.edu<mailto:ndk at internet2.edu>> wrote:
Yaowen,

I think it's using the keypair(and certificate) as configured in metadata to sign assertions:

<ds:SignatureValue>gVi0RA0xHz3UKQIhv464B4i5hrdq88GbL5JgS5m6zUtox7zW3ttBX6gU2QDEb6oXCB/GJ1JAtqYzmjhXXP+TYyVVs+htVhty4aXABj3+0cE/cgKULzksgr42GMOmib7O6Zvy8Yp6mQu72fCSJdDvZsI3bRgq24HOY1Y6qR2rzC78ApVh7u+bnGOx9xil4pFokWGdJTf22xD1ZLYeNzVkO2dKLhK+SSruPR1sbkj6WCTDEiSW5aIxG/hPbx18LzEJBVyiiNq/ppr7OB4xe7GOa3+AJPHNdwxz6BPMXoaHbnG6ITQB1Gx2uKETeqPwW6aytC9DieddJ60zWQt7r/SSkA==</ds:SignatureValue><ds:KeyInfo><ds:X509Data><ds:X509Certificate>MIIEDjCCAvagAwIBAgIBADANBgkqhkiG9w0BAQUFADBnMQswCQYDVQQGEwJVUzEVMBMGA1UECBMM
UGVubnN5bHZhbmlhMRMwEQYDVQQHEwpQaXR0c2J1cmdoMREwDwYDVQQKEwhUZXN0U2hpYjEZMBcG
A1UEAxMQaWRwLnRlc3RzaGliLm9yZzAeFw0wNjA4MzAyMTEyMjVaFw0xNjA4MjcyMTEyMjVaMGcx
CzAJBgNVBAYTAlVTMRUwEwYDVQQIEwxQZW5uc3lsdmFuaWExEzARBgNVBAcTClBpdHRzYnVyZ2gx
ETAPBgNVBAoTCFRlc3RTaGliMRkwFwYDVQQDExBpZHAudGVzdHNoaWIub3JnMIIBIjANBgkqhkiG
9w0BAQEFAAOCAQ8AMIIBCgKCAQEArYkCGuTmJp9eAOSGHwRJo1SNatB5ZOKqDM9ysg7CyVTDClcp
u93gSP10nH4gkCZOlnESNgttg0r+MqL8tfJC6ybddEFB3YBo8PZajKSe3OQ01Ow3yT4I+Wdg1tsT
pSge9gEz7SrC07EkYmHuPtd71CHiUaCWDv+xVfUQX0aTNPFmDixzUjoYzbGDrtAyCqA8f9CN2txI
fJnpHE6q6CmKcoLADS4UrNPlhHSzd614kR/JYiks0K4kbRqCQF0Dv0P5Di+rEfefC6glV8ysC8dB
5/9nb0yh/ojRuJGmgMWHgWk6h0ihjihqiu4jACovUZ7vVOCgSE5Ipn7OIwqd93zp2wIDAQABo4HE
MIHBMB0GA1UdDgQWBBSsBQ869nh83KqZr5jArr4/7b+QazCBkQYDVR0jBIGJMIGGgBSsBQ869nh8
3KqZr5jArr4/7b+Qa6FrpGkwZzELMAkGA1UEBhMCVVMxFTATBgNVBAgTDFBlbm5zeWx2YW5pYTET
MBEGA1UEBxMKUGl0dHNidXJnaDERMA8GA1UEChMIVGVzdFNoaWIxGTAXBgNVBAMTEGlkcC50ZXN0
c2hpYi5vcmeCAQAwDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQUFAAOCAQEAjR29PhrCbk8qLN5M
FfSVk98t3CT9jHZoYxd8QMRLI4j7iYQxXiGJTT1FXs1nd4Rha9un+LqTfeMMYqISdDDI6tv8iNpk
OAvZZUosVkUo93pv1T0RPz35hcHHYq2yee59HJOco2bFlcsH8JBXRSRrJ3Q7Eut+z9uo80JdGNJ4
/SJy5UorZ8KazGj16lfJhOBXldgrhppQBb0Nq6HKHguqmwRfJ+WkxemZXzhediAjGeka8nz8Jjwx
pUjAiSWYKLtJhGEaTqCYxCCX2Dw+dOTqUzHOZ7WKv4JXPK5G/Uhr8K/qhmFT2nIQi538n6rVYLeW
j8Bbnl+ev0peYzxFyF5sQA==</ds:X509Certificate></ds:X509Data></ds:KeyInfo></ds:Signature><saml2:Subject><saml2:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient" NameQualifier="https://idp.testshib.org/idp/shibboleth" SPNameQualifier="https://sp.testshib.org/shibboleth-sp">_4639f7dc6610a693820b8bcbf9123f20</saml2:NameID><saml2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">

                <ds:KeyInfo>
                    <ds:X509Data>
                        <ds:X509Certificate>
                            MIIEDjCCAvagAwIBAgIBADANBgkqhkiG9w0BAQUFADBnMQswCQYDVQQGEwJVUzEV
                            MBMGA1UECBMMUGVubnN5bHZhbmlhMRMwEQYDVQQHEwpQaXR0c2J1cmdoMREwDwYD
                            VQQKEwhUZXN0U2hpYjEZMBcGA1UEAxMQaWRwLnRlc3RzaGliLm9yZzAeFw0wNjA4
                            MzAyMTEyMjVaFw0xNjA4MjcyMTEyMjVaMGcxCzAJBgNVBAYTAlVTMRUwEwYDVQQI
                            EwxQZW5uc3lsdmFuaWExEzARBgNVBAcTClBpdHRzYnVyZ2gxETAPBgNVBAoTCFRl
                            c3RTaGliMRkwFwYDVQQDExBpZHAudGVzdHNoaWIub3JnMIIBIjANBgkqhkiG9w0B
                            AQEFAAOCAQ8AMIIBCgKCAQEArYkCGuTmJp9eAOSGHwRJo1SNatB5ZOKqDM9ysg7C
                            yVTDClcpu93gSP10nH4gkCZOlnESNgttg0r+MqL8tfJC6ybddEFB3YBo8PZajKSe
                            3OQ01Ow3yT4I+Wdg1tsTpSge9gEz7SrC07EkYmHuPtd71CHiUaCWDv+xVfUQX0aT
                            NPFmDixzUjoYzbGDrtAyCqA8f9CN2txIfJnpHE6q6CmKcoLADS4UrNPlhHSzd614
                            kR/JYiks0K4kbRqCQF0Dv0P5Di+rEfefC6glV8ysC8dB5/9nb0yh/ojRuJGmgMWH
                            gWk6h0ihjihqiu4jACovUZ7vVOCgSE5Ipn7OIwqd93zp2wIDAQABo4HEMIHBMB0G
                            A1UdDgQWBBSsBQ869nh83KqZr5jArr4/7b+QazCBkQYDVR0jBIGJMIGGgBSsBQ86
                            9nh83KqZr5jArr4/7b+Qa6FrpGkwZzELMAkGA1UEBhMCVVMxFTATBgNVBAgTDFBl
                            bm5zeWx2YW5pYTETMBEGA1UEBxMKUGl0dHNidXJnaDERMA8GA1UEChMIVGVzdFNo
                            aWIxGTAXBgNVBAMTEGlkcC50ZXN0c2hpYi5vcmeCAQAwDAYDVR0TBAUwAwEB/zAN
                            BgkqhkiG9w0BAQUFAAOCAQEAjR29PhrCbk8qLN5MFfSVk98t3CT9jHZoYxd8QMRL
                            I4j7iYQxXiGJTT1FXs1nd4Rha9un+LqTfeMMYqISdDDI6tv8iNpkOAvZZUosVkUo
                            93pv1T0RPz35hcHHYq2yee59HJOco2bFlcsH8JBXRSRrJ3Q7Eut+z9uo80JdGNJ4
                            /SJy5UorZ8KazGj16lfJhOBXldgrhppQBb0Nq6HKHguqmwRfJ+WkxemZXzhediAj
                            Geka8nz8JjwxpUjAiSWYKLtJhGEaTqCYxCCX2Dw+dOTqUzHOZ7WKv4JXPK5G/Uhr
                            8K/qhmFT2nIQi538n6rVYLeWj8Bbnl+ev0peYzxFyF5sQA==
                        </ds:X509Certificate>
                    </ds:X509Data>
                </ds:KeyInfo>

You might be looking at the encryption key, which corresponds to the SP and also matches metadata.

Thanks,
Nate.

On Apr 18, 2013, at 0:15 , Yaowen Tu wrote:

> Actually I meant that the Assertion is signed. It looks like testshib.org<http://testshib.org/> is using a different certificate to sign the assertion.
>
> Thanks,
> Yaowen
>
> Yaowen
>
>
> On Wed, Apr 17, 2013 at 5:08 PM, Yaowen Tu <yaowen.tu at gmail.com<mailto:yaowen.tu at gmail.com>> wrote:
> But the response returned to my SP is signed. In the Assertion object, the isSigned() flag is true.
>
> Did I miss anything?
>
> Thanks,
> Yaowen
>
> Yaowen
>
>
> On Wed, Apr 17, 2013 at 4:48 PM, Cantor, Scott <cantor.2 at osu.edu<mailto:cantor.2 at osu.edu>> wrote:
> On 4/17/13 7:35 PM, "Yaowen Tu" <yaowen.tu at gmail.com<mailto:yaowen.tu at gmail.com>> wrote:
> >
> >From the SAMLResponse of the testshib.org<http://testshib.org/> <http://testshib.org<http://testshib.org/>> IdP, it
> >contains a different certificate in the <Response> tag.
>
> I just looked at a response from it. Since it's not signing the response,
> there is no certificate in it. So I would guess that given nothing would
> have changed, that you are probably mistaken about the issue.
>
> -- Scott
>
>
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net<mailto:users-unsubscribe at shibboleth.net>
>
>
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net<mailto:users-unsubscribe at shibboleth.net>

--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net<mailto:users-unsubscribe at shibboleth.net>

--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net<mailto:users-unsubscribe at shibboleth.net>

--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net<mailto:users-unsubscribe at shibboleth.net>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130418/8e472741/attachment-0001.html 