Is testshib.org sending a different certificate when returning an Assertion to my SP?
Yaowen Tu
yaowen.tu at gmail.com
Thu Apr 18 14:00:30 EDT 2013
Thanks. I tested again now it works.
The problem is that I was retrieving idp metadata file from
https://idp.testshib.org/idp/shibboleth.
The reason I did that because in this page:
https://www.testshib.org/configure.html, I don't see a place that tells me
where should I get the idp metadata file.
I had to generate a shibboleth2.xml and read the file in order to get the
correct URL for the IdP metadata file.
It is working now since I see that the metadata file in
https://idp.testshib.org/idp/shibboleth is updated as well.
By the way, can you tell me which tool I should use to translate the
encoded certificate into human readable format?
Yaowen
Yaowen
On Wed, Apr 17, 2013 at 6:52 PM, Nate Klingenstein <ndk at internet2.edu>wrote:
> Wait, I compared the wrong certificates. These two are obviously
> identical. base64 makes my head spin.
>
> The first certificate you pasted doesn't match any certificate that was
> configured into the IdP. Here are those two:
>
> -----BEGIN CERTIFICATE-----
> MIIEDjCCAvagAwIBAgIBADANBgkqhkiG9w0BAQUFADBnMQswCQYDVQQGEwJVUzEV
> MBMGA1UECBMMUGVubnN5bHZhbmlhMRMwEQYDVQQHEwpQaXR0c2J1cmdoMREwDwYD
> VQQKEwhUZXN0U2hpYjEZMBcGA1UEAxMQaWRwLnRlc3RzaGliLm9yZzAeFw0wNjA4
> MzAyMTEyMjVaFw0xNjA4MjcyMTEyMjVaMGcxCzAJBgNVBAYTAlVTMRUwEwYDVQQI
> EwxQZW5uc3lsdmFuaWExEzARBgNVBAcTClBpdHRzYnVyZ2gxETAPBgNVBAoTCFRl
> c3RTaGliMRkwFwYDVQQDExBpZHAudGVzdHNoaWIub3JnMIIBIjANBgkqhkiG9w0B
> AQEFAAOCAQ8AMIIBCgKCAQEArYkCGuTmJp9eAOSGHwRJo1SNatB5ZOKqDM9ysg7C
> yVTDClcpu93gSP10nH4gkCZOlnESNgttg0r+MqL8tfJC6ybddEFB3YBo8PZajKSe
> 3OQ01Ow3yT4I+Wdg1tsTpSge9gEz7SrC07EkYmHuPtd71CHiUaCWDv+xVfUQX0aT
> NPFmDixzUjoYzbGDrtAyCqA8f9CN2txIfJnpHE6q6CmKcoLADS4UrNPlhHSzd614
> kR/JYiks0K4kbRqCQF0Dv0P5Di+rEfefC6glV8ysC8dB5/9nb0yh/ojRuJGmgMWH
> gWk6h0ihjihqiu4jACovUZ7vVOCgSE5Ipn7OIwqd93zp2wIDAQABo4HEMIHBMB0G
> A1UdDgQWBBSsBQ869nh83KqZr5jArr4/7b+QazCBkQYDVR0jBIGJMIGGgBSsBQ86
> 9nh83KqZr5jArr4/7b+Qa6FrpGkwZzELMAkGA1UEBhMCVVMxFTATBgNVBAgTDFBl
> bm5zeWx2YW5pYTETMBEGA1UEBxMKUGl0dHNidXJnaDERMA8GA1UEChMIVGVzdFNo
> aWIxGTAXBgNVBAMTEGlkcC50ZXN0c2hpYi5vcmeCAQAwDAYDVR0TBAUwAwEB/zAN
> BgkqhkiG9w0BAQUFAAOCAQEAjR29PhrCbk8qLN5MFfSVk98t3CT9jHZoYxd8QMRL
> I4j7iYQxXiGJTT1FXs1nd4Rha9un+LqTfeMMYqISdDDI6tv8iNpkOAvZZUosVkUo
> 93pv1T0RPz35hcHHYq2yee59HJOco2bFlcsH8JBXRSRrJ3Q7Eut+z9uo80JdGNJ4
> /SJy5UorZ8KazGj16lfJhOBXldgrhppQBb0Nq6HKHguqmwRfJ+WkxemZXzhediAj
> Geka8nz8JjwxpUjAiSWYKLtJhGEaTqCYxCCX2Dw+dOTqUzHOZ7WKv4JXPK5G/Uhr
> 8K/qhmFT2nIQi538n6rVYLeWj8Bbnl+ev0peYzxFyF5sQA==
> -----END CERTIFICATE-----
>
> -----BEGIN CERTIFICATE-----
> MIIFgzCCBGugAwIBAgIQMvQPGrnmbSxKSh88nn3ymDANBgkqhkiG9w0BAQUFADBR
> MQswCQYDVQQGEwJVUzESMBAGA1UEChMJSW50ZXJuZXQyMREwDwYDVQQLEwhJbkNv
> bW1vbjEbMBkGA1UEAxMSSW5Db21tb24gU2VydmVyIENBMB4XDTExMDMxNjAwMDAw
> MFoXDTE0MDMxNTIzNTk1OVowgccxCzAJBgNVBAYTAlVTMQ4wDAYDVQQREwU0ODEw
> NDELMAkGA1UECBMCTUkxEjAQBgNVBAcTCUFubiBBcmJvcjESMBAGA1UECRMJU3Vp
> dGUgMzAwMRwwGgYDVQQJExMxMDAwIE9ha2Jyb29rIERyaXZlMRIwEAYDVQQKEwlJ
> bnRlcm5ldDIxJjAkBgNVBAsTHUNvbW9kbyBVbmlmaWVkIENvbW11bmljYXRpb25z
> MRkwFwYDVQQDExB3d3cudGVzdHNoaWIub3JnMIIBIjANBgkqhkiG9w0BAQEFAAOC
> AQ8AMIIBCgKCAQEA2e2qmHt9n+yFY8tfEFEB/E1JsCOG4vuagmGnuiuTPQwt7fOT
> ip1dce2i1VQu0/gDF3sw0jwBsAlkymnZZQNeIRZJgMooir3dfe870FFG/NiCstN1
> qBXwY/4lRVbX31EnpIegrWmwwmqs3oruvxWVAwYaI43s52oBafr8D71RL2NS9edH
> VMT1ThTFIkxWlcwyL3ipAcIXR378t6LDTSILfqCcDqfxJr+XVabTFPS/Q2RjIzZs
> QpRA0fsue+hNhgTTCu36r3aGcJicsU2IcmIWeQ8eQvSoWz0IiKtYtpdbCUSjZ1f+
> 9GK+ikeBXrSQCQAvTzDvOK1nArZAHTkQpyMMjQIDAQABo4IB3jCCAdowHwYDVR0j
> BBgwFoAUSE9a+i9Kml7gUPNre1Wl3vW+NF0wHQYDVR0OBBYEFJknhhlD5AqY8/2j
> HLU1x+FO4/hNMA4GA1UdDwEB/wQEAwIFoDAMBgNVHRMBAf8EAjAAMB0GA1UdJQQW
> MBQGCCsGAQUFBwMBBggrBgEFBQcDAjBdBgNVHSAEVjBUMFIGDCsGAQQBriMBBAMB
> ATBCMEAGCCsGAQUFBwIBFjRodHRwczovL3d3dy5pbmNvbW1vbi5vcmcvY2VydC9y
> ZXBvc2l0b3J5L2Nwc19zc2wucGRmMD0GA1UdHwQ2MDQwMqAwoC6GLGh0dHA6Ly9j
> cmwuaW5jb21tb24ub3JnL0luQ29tbW9uU2VydmVyQ0EuY3JsMG8GCCsGAQUFBwEB
> BGMwYTA5BggrBgEFBQcwAoYtaHR0cDovL2NlcnQuaW5jb21tb24ub3JnL0luQ29t
> bW9uU2VydmVyQ0EuY3J0MCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5pbmNvbW1v
> bi5vcmcwTAYDVR0RBEUwQ4IQd3d3LnRlc3RzaGliLm9yZ4IQaWRwLnRlc3RzaGli
> Lm9yZ4IPc3AudGVzdHNoaWIub3Jnggx0ZXN0c2hpYi5vcmcwDQYJKoZIhvcNAQEF
> BQADggEBABFlHMQCVMAyDFquFmP32XZpKbkVW01pUOBiO+XwtjNDbbEmM70UMWr2
> Iyke/4NolOedxLYW2efL2/fmW30boH1sP07WHjz9kh+bQKhzD3PmO+j5ywxEQFwB
> Qz6IeKxotmxuB/5Mm1bphcSKMTjDO8ubkW4yh7iWKqYYeVRzcDyyYMl5VdbLD/fP
> C6s4c/vn7YAGbiDkLEU8eYgaaJz+AW3oAtJg0TGRyBTDFbnXTUlPsg85knGsfiWK
> lXVslLTL+bZnwIgeWLw/OrJj8DfRNNnXp62k490h/4tkrqrhX5s92FbS6wpmPtQp
> YkOvOCbkU0GT9gLufMryWBGczlvgycU=
> -----END CERTIFICATE-----
>
> You appear to be using the IdP's auto-generated metadata file(
> https://idp.testshib.org/idp/profile/Metadata/SAML) which was never
> updated with actual keys nor used in any documentation that I know of. The
> documentation all points to a different file (
> https://www.testshib.org/metadata/testshib-providers.xml).
>
> Did you find this in any documentation that we maintain?
>
> Nevertheless, I've updated the IdP's metadata handler to point
> to testshib-providers.xml.
>
> I've left the other credential pair commented out because it was just
> cruft.
>
> On Apr 18, 2013, at 1:34 , Nate Klingenstein wrote:
>
> Yaowen,
>
> They have the same public key:
>
> Certificate:
> Data:
> Version: 3 (0x2)
> Serial Number: 0 (0x0)
> Signature Algorithm: sha1WithRSAEncryption
> Issuer: C=US, ST=Pennsylvania, L=Pittsburgh, O=TestShib, CN=
> idp.testshib.org
> Validity
> Not Before: Aug 30 21:12:25 2006 GMT
> Not After : Aug 27 21:12:25 2016 GMT
> Subject: C=US, ST=Pennsylvania, L=Pittsburgh, O=TestShib, CN=
> idp.testshib.org
> Subject Public Key Info:
> Public Key Algorithm: rsaEncryption
> Public-Key: (2048 bit)
> Modulus:
> 00:ad:89:02:1a:e4:e6:26:9f:5e:00:e4:86:1f:04:
> 49:a3:54:8d:6a:d0:79:64:e2:aa:0c:cf:72:b2:0e:
> c2:c9:54:c3:0a:57:29:bb:dd:e0:48:fd:74:9c:7e:
> 20:90:26:4e:96:71:12:36:0b:6d:83:4a:fe:32:a2:
> fc:b5:f2:42:eb:26:dd:74:41:41:dd:80:68:f0:f6:
> 5a:8c:a4:9e:dc:e4:34:d4:ec:37:c9:3e:08:f9:67:
> 60:d6:db:13:a5:28:1e:f6:01:33:ed:2a:c2:d3:b1:
> 24:62:61:ee:3e:d7:7b:d4:21:e2:51:a0:96:0e:ff:
> b1:55:f5:10:5f:46:93:34:f1:66:0e:2c:73:52:3a:
> 18:cd:b1:83:ae:d0:32:0a:a0:3c:7f:d0:8d:da:dc:
> 48:7c:99:e9:1c:4e:aa:e8:29:8a:72:82:c0:0d:2e:
> 14:ac:d3:e5:84:74:b3:77:ad:78:91:1f:c9:62:29:
> 2c:d0:ae:24:6d:1a:82:40:5d:03:bf:43:f9:0e:2f:
> ab:11:f7:9f:0b:a8:25:57:cc:ac:0b:c7:41:e7:ff:
> 67:6f:4c:a1:fe:88:d1:b8:91:a6:80:c5:87:81:69:
> 3a:87:48:a1:8e:28:6a:8a:ee:23:00:2a:2f:51:9e:
> ef:54:e0:a0:48:4e:48:a6:7e:ce:23:0a:9d:f7:7c:
> e9:db
> Exponent: 65537 (0x10001)
> X509v3 extensions:
> X509v3 Subject Key Identifier:
> AC:05:0F:3A:F6:78:7C:DC:AA:99:AF:98:C0:AE:BE:3F:ED:BF:90:6B
> X509v3 Authority Key Identifier:
>
> keyid:AC:05:0F:3A:F6:78:7C:DC:AA:99:AF:98:C0:AE:BE:3F:ED:BF:90:6B
> DirName:/C=US/ST=Pennsylvania/L=Pittsburgh/O=TestShib/CN=
> idp.testshib.org
> serial:00
>
> X509v3 Basic Constraints:
> CA:TRUE
> Signature Algorithm: sha1WithRSAEncryption
> 8d:1d:bd:3e:1a:c2:6e:4f:2a:2c:de:4c:15:f4:95:93:df:2d:
> dc:24:fd:8c:76:68:63:17:7c:40:c4:4b:23:88:fb:89:84:31:
> 5e:21:89:4d:3d:45:5e:cd:67:77:84:61:6b:db:a7:f8:ba:93:
> 7d:e3:0c:62:a2:12:74:30:c8:ea:db:fc:88:da:64:38:0b:d9:
> 65:4a:2c:56:45:28:f7:7a:6f:d5:3d:11:3f:3d:f9:85:c1:c7:
> 62:ad:b2:79:ee:7d:1c:93:9c:a3:66:c5:95:cb:07:f0:90:57:
> 45:24:6b:27:74:3b:12:eb:7e:cf:db:a8:f3:42:5d:18:d2:78:
> fd:22:72:e5:4a:2b:67:c2:9a:cc:68:f5:ea:57:c9:84:e0:57:
> 95:d8:2b:86:9a:50:05:bd:0d:ab:a1:ca:1e:0b:aa:9b:04:5f:
> 27:e5:a4:c5:e9:99:5f:38:5e:76:20:23:19:e9:1a:f2:7c:fc:
> 26:3c:31:a5:48:c0:89:25:98:28:bb:49:84:61:1a:4e:a0:98:
> c4:20:97:d8:3c:3e:74:e4:ea:53:31:ce:67:b5:8a:bf:82:57:
> 3c:ae:46:fd:48:6b:f0:af:ea:86:61:53:da:72:10:8b:9d:fc:
> 9f:aa:d5:60:b7:96:8f:c0:5b:9e:5f:9e:bf:4a:5e:63:3c:45:
> c8:5e:6c:40
> -----BEGIN CERTIFICATE-----
> MIIEDjCCAvagAwIBAgIBADANBgkqhkiG9w0BAQUFADBnMQswCQYDVQQGEwJVUzEV
> MBMGA1UECBMMUGVubnN5bHZhbmlhMRMwEQYDVQQHEwpQaXR0c2J1cmdoMREwDwYD
> VQQKEwhUZXN0U2hpYjEZMBcGA1UEAxMQaWRwLnRlc3RzaGliLm9yZzAeFw0wNjA4
> MzAyMTEyMjVaFw0xNjA4MjcyMTEyMjVaMGcxCzAJBgNVBAYTAlVTMRUwEwYDVQQI
> EwxQZW5uc3lsdmFuaWExEzARBgNVBAcTClBpdHRzYnVyZ2gxETAPBgNVBAoTCFRl
> c3RTaGliMRkwFwYDVQQDExBpZHAudGVzdHNoaWIub3JnMIIBIjANBgkqhkiG9w0B
> AQEFAAOCAQ8AMIIBCgKCAQEArYkCGuTmJp9eAOSGHwRJo1SNatB5ZOKqDM9ysg7C
> yVTDClcpu93gSP10nH4gkCZOlnESNgttg0r+MqL8tfJC6ybddEFB3YBo8PZajKSe
> 3OQ01Ow3yT4I+Wdg1tsTpSge9gEz7SrC07EkYmHuPtd71CHiUaCWDv+xVfUQX0aT
> NPFmDixzUjoYzbGDrtAyCqA8f9CN2txIfJnpHE6q6CmKcoLADS4UrNPlhHSzd614
> kR/JYiks0K4kbRqCQF0Dv0P5Di+rEfefC6glV8ysC8dB5/9nb0yh/ojRuJGmgMWH
> gWk6h0ihjihqiu4jACovUZ7vVOCgSE5Ipn7OIwqd93zp2wIDAQABo4HEMIHBMB0G
> A1UdDgQWBBSsBQ869nh83KqZr5jArr4/7b+QazCBkQYDVR0jBIGJMIGGgBSsBQ86
> 9nh83KqZr5jArr4/7b+Qa6FrpGkwZzELMAkGA1UEBhMCVVMxFTATBgNVBAgTDFBl
> bm5zeWx2YW5pYTETMBEGA1UEBxMKUGl0dHNidXJnaDERMA8GA1UEChMIVGVzdFNo
> aWIxGTAXBgNVBAMTEGlkcC50ZXN0c2hpYi5vcmeCAQAwDAYDVR0TBAUwAwEB/zAN
> BgkqhkiG9w0BAQUFAAOCAQEAjR29PhrCbk8qLN5MFfSVk98t3CT9jHZoYxd8QMRL
> I4j7iYQxXiGJTT1FXs1nd4Rha9un+LqTfeMMYqISdDDI6tv8iNpkOAvZZUosVkUo
> 93pv1T0RPz35hcHHYq2yee59HJOco2bFlcsH8JBXRSRrJ3Q7Eut+z9uo80JdGNJ4
> /SJy5UorZ8KazGj16lfJhOBXldgrhppQBb0Nq6HKHguqmwRfJ+WkxemZXzhediAj
> Geka8nz8JjwxpUjAiSWYKLtJhGEaTqCYxCCX2Dw+dOTqUzHOZ7WKv4JXPK5G/Uhr
> 8K/qhmFT2nIQi538n6rVYLeWj8Bbnl+ev0peYzxFyF5sQA==
> -----END CERTIFICATE-----
>
> Certificate:
> Data:
> Version: 3 (0x2)
> Serial Number: 0 (0x0)
> Signature Algorithm: sha1WithRSAEncryption
> Issuer: C=US, ST=Pennsylvania, L=Pittsburgh, O=TestShib, CN=
> idp.testshib.org
> Validity
> Not Before: Aug 30 21:12:25 2006 GMT
> Not After : Aug 27 21:12:25 2016 GMT
> Subject: C=US, ST=Pennsylvania, L=Pittsburgh, O=TestShib, CN=
> idp.testshib.org
> Subject Public Key Info:
> Public Key Algorithm: rsaEncryption
> Public-Key: (2048 bit)
> Modulus:
> 00:ad:89:02:1a:e4:e6:26:9f:5e:00:e4:86:1f:04:
> 49:a3:54:8d:6a:d0:79:64:e2:aa:0c:cf:72:b2:0e:
> c2:c9:54:c3:0a:57:29:bb:dd:e0:48:fd:74:9c:7e:
> 20:90:26:4e:96:71:12:36:0b:6d:83:4a:fe:32:a2:
> fc:b5:f2:42:eb:26:dd:74:41:41:dd:80:68:f0:f6:
> 5a:8c:a4:9e:dc:e4:34:d4:ec:37:c9:3e:08:f9:67:
> 60:d6:db:13:a5:28:1e:f6:01:33:ed:2a:c2:d3:b1:
> 24:62:61:ee:3e:d7:7b:d4:21:e2:51:a0:96:0e:ff:
> b1:55:f5:10:5f:46:93:34:f1:66:0e:2c:73:52:3a:
> 18:cd:b1:83:ae:d0:32:0a:a0:3c:7f:d0:8d:da:dc:
> 48:7c:99:e9:1c:4e:aa:e8:29:8a:72:82:c0:0d:2e:
> 14:ac:d3:e5:84:74:b3:77:ad:78:91:1f:c9:62:29:
> 2c:d0:ae:24:6d:1a:82:40:5d:03:bf:43:f9:0e:2f:
> ab:11:f7:9f:0b:a8:25:57:cc:ac:0b:c7:41:e7:ff:
> 67:6f:4c:a1:fe:88:d1:b8:91:a6:80:c5:87:81:69:
> 3a:87:48:a1:8e:28:6a:8a:ee:23:00:2a:2f:51:9e:
> ef:54:e0:a0:48:4e:48:a6:7e:ce:23:0a:9d:f7:7c:
> e9:db
> Exponent: 65537 (0x10001)
> X509v3 extensions:
> X509v3 Subject Key Identifier:
> AC:05:0F:3A:F6:78:7C:DC:AA:99:AF:98:C0:AE:BE:3F:ED:BF:90:6B
> X509v3 Authority Key Identifier:
>
> keyid:AC:05:0F:3A:F6:78:7C:DC:AA:99:AF:98:C0:AE:BE:3F:ED:BF:90:6B
> DirName:/C=US/ST=Pennsylvania/L=Pittsburgh/O=TestShib/CN=
> idp.testshib.org
> serial:00
>
> X509v3 Basic Constraints:
> CA:TRUE
> Signature Algorithm: sha1WithRSAEncryption
> 8d:1d:bd:3e:1a:c2:6e:4f:2a:2c:de:4c:15:f4:95:93:df:2d:
> dc:24:fd:8c:76:68:63:17:7c:40:c4:4b:23:88:fb:89:84:31:
> 5e:21:89:4d:3d:45:5e:cd:67:77:84:61:6b:db:a7:f8:ba:93:
> 7d:e3:0c:62:a2:12:74:30:c8:ea:db:fc:88:da:64:38:0b:d9:
> 65:4a:2c:56:45:28:f7:7a:6f:d5:3d:11:3f:3d:f9:85:c1:c7:
> 62:ad:b2:79:ee:7d:1c:93:9c:a3:66:c5:95:cb:07:f0:90:57:
> 45:24:6b:27:74:3b:12:eb:7e:cf:db:a8:f3:42:5d:18:d2:78:
> fd:22:72:e5:4a:2b:67:c2:9a:cc:68:f5:ea:57:c9:84:e0:57:
> 95:d8:2b:86:9a:50:05:bd:0d:ab:a1:ca:1e:0b:aa:9b:04:5f:
> 27:e5:a4:c5:e9:99:5f:38:5e:76:20:23:19:e9:1a:f2:7c:fc:
> 26:3c:31:a5:48:c0:89:25:98:28:bb:49:84:61:1a:4e:a0:98:
> c4:20:97:d8:3c:3e:74:e4:ea:53:31:ce:67:b5:8a:bf:82:57:
> 3c:ae:46:fd:48:6b:f0:af:ea:86:61:53:da:72:10:8b:9d:fc:
> 9f:aa:d5:60:b7:96:8f:c0:5b:9e:5f:9e:bf:4a:5e:63:3c:45:
> c8:5e:6c:40
> -----BEGIN CERTIFICATE-----
> MIIEDjCCAvagAwIBAgIBADANBgkqhkiG9w0BAQUFADBnMQswCQYDVQQGEwJVUzEV
> MBMGA1UECBMMUGVubnN5bHZhbmlhMRMwEQYDVQQHEwpQaXR0c2J1cmdoMREwDwYD
> VQQKEwhUZXN0U2hpYjEZMBcGA1UEAxMQaWRwLnRlc3RzaGliLm9yZzAeFw0wNjA4
> MzAyMTEyMjVaFw0xNjA4MjcyMTEyMjVaMGcxCzAJBgNVBAYTAlVTMRUwEwYDVQQI
> EwxQZW5uc3lsdmFuaWExEzARBgNVBAcTClBpdHRzYnVyZ2gxETAPBgNVBAoTCFRl
> c3RTaGliMRkwFwYDVQQDExBpZHAudGVzdHNoaWIub3JnMIIBIjANBgkqhkiG9w0B
> AQEFAAOCAQ8AMIIBCgKCAQEArYkCGuTmJp9eAOSGHwRJo1SNatB5ZOKqDM9ysg7C
> yVTDClcpu93gSP10nH4gkCZOlnESNgttg0r+MqL8tfJC6ybddEFB3YBo8PZajKSe
> 3OQ01Ow3yT4I+Wdg1tsTpSge9gEz7SrC07EkYmHuPtd71CHiUaCWDv+xVfUQX0aT
> NPFmDixzUjoYzbGDrtAyCqA8f9CN2txIfJnpHE6q6CmKcoLADS4UrNPlhHSzd614
> kR/JYiks0K4kbRqCQF0Dv0P5Di+rEfefC6glV8ysC8dB5/9nb0yh/ojRuJGmgMWH
> gWk6h0ihjihqiu4jACovUZ7vVOCgSE5Ipn7OIwqd93zp2wIDAQABo4HEMIHBMB0G
> A1UdDgQWBBSsBQ869nh83KqZr5jArr4/7b+QazCBkQYDVR0jBIGJMIGGgBSsBQ86
> 9nh83KqZr5jArr4/7b+Qa6FrpGkwZzELMAkGA1UEBhMCVVMxFTATBgNVBAgTDFBl
> bm5zeWx2YW5pYTETMBEGA1UEBxMKUGl0dHNidXJnaDERMA8GA1UEChMIVGVzdFNo
> aWIxGTAXBgNVBAMTEGlkcC50ZXN0c2hpYi5vcmeCAQAwDAYDVR0TBAUwAwEB/zAN
> BgkqhkiG9w0BAQUFAAOCAQEAjR29PhrCbk8qLN5MFfSVk98t3CT9jHZoYxd8QMRL
> I4j7iYQxXiGJTT1FXs1nd4Rha9un+LqTfeMMYqISdDDI6tv8iNpkOAvZZUosVkUo
> 93pv1T0RPz35hcHHYq2yee59HJOco2bFlcsH8JBXRSRrJ3Q7Eut+z9uo80JdGNJ4
> /SJy5UorZ8KazGj16lfJhOBXldgrhppQBb0Nq6HKHguqmwRfJ+WkxemZXzhediAj
> Geka8nz8JjwxpUjAiSWYKLtJhGEaTqCYxCCX2Dw+dOTqUzHOZ7WKv4JXPK5G/Uhr
> 8K/qhmFT2nIQi538n6rVYLeWj8Bbnl+ev0peYzxFyF5sQA==
> -----END CERTIFICATE-----
>
> I'm not sure why it would be using the second certificate to sign
> messages to you, though. It's not used in other transactions from what I
> can tell. It is configured into the IdP as part of an old certificate
> rollover.
>
> I've commented out the certificate that I believe is leftover. You can
> try it again now.
>
> On Apr 18, 2013, at 1:00 , Yaowen Tu wrote:
>
> Scott,
>
> Sorry about that I should have been more careful when I send out the first
> email.
>
> I am trying to use certificate viewer to view the X509Certificate, and it
> looks like they are different:
>
> This is the X509Certificate captured from idp metadata file:
> MIIDKzCCAhOgAwIBAgIUBmArgGbiur6uu2YfHg5RCcmZWkQwDQYJKoZIhvcNAQEF
> BQAwGzEZMBcGA1UEAxMQaWRwLnRlc3RzaGliLm9yZzAeFw0xMjAyMjQwMTEwMDla
> Fw0zMjAyMjQwMTEwMDlaMBsxGTAXBgNVBAMTEGlkcC50ZXN0c2hpYi5vcmcwggEi
> MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCUS4L8kz+wB94NmjiNh0Ff3KuB
> tM2L/oeBzpQJoTALQ5HLnZdCWHRaQYD2LV2lp1zPQTBpS1aRghGrHUrBCuowq172
> H9RcEk3vOb44NnVmxFCBTIbCDv6SjjLBY35QTwzcQVwWLIMq833Wt4dQKrapfwJr
> p8jJd8RobpFJl0K3BbwtFTa3gBL+FDT5jYpsmld3oOLDSgUG+lqcjjVPQMgY+FC2
> Jb/tyzMibd8AFUTck1TYZ8uSk44XtYfTMvz3fZYCNsympxGUVk5Qno2AoZvObSbF
> unC2MSEjKQzEmdwBUJkIhV81sjC+ofH4JuImY9y7I5BA62HET5/J8/SpKV0BAgMB
> AAGjZzBlMEQGA1UdEQQ9MDuCEGlkcC50ZXN0c2hpYi5vcmeGJ2h0dHBzOi8vaWRw
> LnRlc3RzaGliLm9yZy9pZHAvc2hpYmJvbGV0aDAdBgNVHQ4EFgQUtEusYC7zyykK
> OxNnq+L9Wo67uy8wDQYJKoZIhvcNAQEFBQADggEBABr3g1EG530HWcovEFo/3RC9
> AWnD0I7zEbFZEDdMPHRdmdjpzskMF6J+Olq86qBaKL5Wn92BNIPmJvFpypokRmlo
> kti7aJqvjggXNRG+6yLqBbZX4P1cK6tyT8SAZ5zwn52uw1+XFJS6HHUtPLcbnhXe
> 2YnXpgEE6dkx1BhEL+vKSFOeLlFiGiex3DsA5j4qpR+Za2FTbAWl0eU8H4ipMNTp
> CdSxaerQTV4NMw5asLXDtRF5AMBwv2nXer+MOx2YN6t85+TCaXeQlx9svl2a5JTz
> 1Hayl8yhcskcx9B2O2DTQsgL0lFWeogJ2O8qoHI0eST/mCDDbnfKZ7uGuGswyws=
>
> This is the certificate in the <Assertion> tag that return to my SP:
>
> MIIEDjCCAvagAwIBAgIBADANBgkqhkiG9w0BAQUFADBnMQswCQYDVQQGEwJVUzEVMBMGA1UECBMM
>
> UGVubnN5bHZhbmlhMRMwEQYDVQQHEwpQaXR0c2J1cmdoMREwDwYDVQQKEwhUZXN0U2hpYjEZMBcG
>
> A1UEAxMQaWRwLnRlc3RzaGliLm9yZzAeFw0wNjA4MzAyMTEyMjVaFw0xNjA4MjcyMTEyMjVaMGcx
>
> CzAJBgNVBAYTAlVTMRUwEwYDVQQIEwxQZW5uc3lsdmFuaWExEzARBgNVBAcTClBpdHRzYnVyZ2gx
>
> ETAPBgNVBAoTCFRlc3RTaGliMRkwFwYDVQQDExBpZHAudGVzdHNoaWIub3JnMIIBIjANBgkqhkiG
>
> 9w0BAQEFAAOCAQ8AMIIBCgKCAQEArYkCGuTmJp9eAOSGHwRJo1SNatB5ZOKqDM9ysg7CyVTDClcp
>
> u93gSP10nH4gkCZOlnESNgttg0r+MqL8tfJC6ybddEFB3YBo8PZajKSe3OQ01Ow3yT4I+Wdg1tsT
>
> pSge9gEz7SrC07EkYmHuPtd71CHiUaCWDv+xVfUQX0aTNPFmDixzUjoYzbGDrtAyCqA8f9CN2txI
>
> fJnpHE6q6CmKcoLADS4UrNPlhHSzd614kR/JYiks0K4kbRqCQF0Dv0P5Di+rEfefC6glV8ysC8dB
>
> 5/9nb0yh/ojRuJGmgMWHgWk6h0ihjihqiu4jACovUZ7vVOCgSE5Ipn7OIwqd93zp2wIDAQABo4HE
>
> MIHBMB0GA1UdDgQWBBSsBQ869nh83KqZr5jArr4/7b+QazCBkQYDVR0jBIGJMIGGgBSsBQ869nh8
>
> 3KqZr5jArr4/7b+Qa6FrpGkwZzELMAkGA1UEBhMCVVMxFTATBgNVBAgTDFBlbm5zeWx2YW5pYTET
>
> MBEGA1UEBxMKUGl0dHNidXJnaDERMA8GA1UEChMIVGVzdFNoaWIxGTAXBgNVBAMTEGlkcC50ZXN0
>
> c2hpYi5vcmeCAQAwDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQUFAAOCAQEAjR29PhrCbk8qLN5M
>
> FfSVk98t3CT9jHZoYxd8QMRLI4j7iYQxXiGJTT1FXs1nd4Rha9un+LqTfeMMYqISdDDI6tv8iNpk
>
> OAvZZUosVkUo93pv1T0RPz35hcHHYq2yee59HJOco2bFlcsH8JBXRSRrJ3Q7Eut+z9uo80JdGNJ4
>
> /SJy5UorZ8KazGj16lfJhOBXldgrhppQBb0Nq6HKHguqmwRfJ+WkxemZXzhediAjGeka8nz8Jjwx
>
> pUjAiSWYKLtJhGEaTqCYxCCX2Dw+dOTqUzHOZ7WKv4JXPK5G/Uhr8K/qhmFT2nIQi538n6rVYLeW
>
> Can you confirm if they are using the same key to generate the digest? I
> am not farmiliar with this part, if you can tell me how to do that I would
> be glad to do it by myself.
>
> Thanks
> Yaowen
>
> Yaowen
>
>
> On Wed, Apr 17, 2013 at 5:42 PM, Nate Klingenstein <ndk at internet2.edu>wrote:
>
>> Yaowen,
>>
>> I think it's using the keypair(and certificate) as configured in metadata
>> to sign assertions:
>>
>>
>> <ds:SignatureValue>gVi0RA0xHz3UKQIhv464B4i5hrdq88GbL5JgS5m6zUtox7zW3ttBX6gU2QDEb6oXCB/GJ1JAtqYzmjhXXP+TYyVVs+htVhty4aXABj3+0cE/cgKULzksgr42GMOmib7O6Zvy8Yp6mQu72fCSJdDvZsI3bRgq24HOY1Y6qR2rzC78ApVh7u+bnGOx9xil4pFokWGdJTf22xD1ZLYeNzVkO2dKLhK+SSruPR1sbkj6WCTDEiSW5aIxG/hPbx18LzEJBVyiiNq/ppr7OB4xe7GOa3+AJPHNdwxz6BPMXoaHbnG6ITQB1Gx2uKETeqPwW6aytC9DieddJ60zWQt7r/SSkA==</ds:SignatureValue><ds:KeyInfo><ds:X509Data><ds:X509Certificate>MIIEDjCCAvagAwIBAgIBADANBgkqhkiG9w0BAQUFADBnMQswCQYDVQQGEwJVUzEVMBMGA1UECBMM
>>
>> UGVubnN5bHZhbmlhMRMwEQYDVQQHEwpQaXR0c2J1cmdoMREwDwYDVQQKEwhUZXN0U2hpYjEZMBcG
>>
>> A1UEAxMQaWRwLnRlc3RzaGliLm9yZzAeFw0wNjA4MzAyMTEyMjVaFw0xNjA4MjcyMTEyMjVaMGcx
>>
>> CzAJBgNVBAYTAlVTMRUwEwYDVQQIEwxQZW5uc3lsdmFuaWExEzARBgNVBAcTClBpdHRzYnVyZ2gx
>>
>> ETAPBgNVBAoTCFRlc3RTaGliMRkwFwYDVQQDExBpZHAudGVzdHNoaWIub3JnMIIBIjANBgkqhkiG
>>
>> 9w0BAQEFAAOCAQ8AMIIBCgKCAQEArYkCGuTmJp9eAOSGHwRJo1SNatB5ZOKqDM9ysg7CyVTDClcp
>>
>> u93gSP10nH4gkCZOlnESNgttg0r+MqL8tfJC6ybddEFB3YBo8PZajKSe3OQ01Ow3yT4I+Wdg1tsT
>>
>> pSge9gEz7SrC07EkYmHuPtd71CHiUaCWDv+xVfUQX0aTNPFmDixzUjoYzbGDrtAyCqA8f9CN2txI
>>
>> fJnpHE6q6CmKcoLADS4UrNPlhHSzd614kR/JYiks0K4kbRqCQF0Dv0P5Di+rEfefC6glV8ysC8dB
>>
>> 5/9nb0yh/ojRuJGmgMWHgWk6h0ihjihqiu4jACovUZ7vVOCgSE5Ipn7OIwqd93zp2wIDAQABo4HE
>>
>> MIHBMB0GA1UdDgQWBBSsBQ869nh83KqZr5jArr4/7b+QazCBkQYDVR0jBIGJMIGGgBSsBQ869nh8
>>
>> 3KqZr5jArr4/7b+Qa6FrpGkwZzELMAkGA1UEBhMCVVMxFTATBgNVBAgTDFBlbm5zeWx2YW5pYTET
>>
>> MBEGA1UEBxMKUGl0dHNidXJnaDERMA8GA1UEChMIVGVzdFNoaWIxGTAXBgNVBAMTEGlkcC50ZXN0
>>
>> c2hpYi5vcmeCAQAwDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQUFAAOCAQEAjR29PhrCbk8qLN5M
>>
>> FfSVk98t3CT9jHZoYxd8QMRLI4j7iYQxXiGJTT1FXs1nd4Rha9un+LqTfeMMYqISdDDI6tv8iNpk
>>
>> OAvZZUosVkUo93pv1T0RPz35hcHHYq2yee59HJOco2bFlcsH8JBXRSRrJ3Q7Eut+z9uo80JdGNJ4
>>
>> /SJy5UorZ8KazGj16lfJhOBXldgrhppQBb0Nq6HKHguqmwRfJ+WkxemZXzhediAjGeka8nz8Jjwx
>>
>> pUjAiSWYKLtJhGEaTqCYxCCX2Dw+dOTqUzHOZ7WKv4JXPK5G/Uhr8K/qhmFT2nIQi538n6rVYLeW
>> j8Bbnl+ev0peYzxFyF5sQA==</ds:X509Certificate></ds:X509Data></ds:KeyInfo></ds:Signature><saml2:Subject><saml2:NameID
>> Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient" NameQualifier="
>> https://idp.testshib.org/idp/shibboleth" SPNameQualifier="
>> https://sp.testshib.org/shibboleth-sp">_4639f7dc6610a693820b8bcbf9123f20</saml2:NameID><saml2:SubjectConfirmation
>> Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
>>
>>
>>
>> <ds:KeyInfo>
>> <ds:X509Data>
>> <ds:X509Certificate>
>>
>> MIIEDjCCAvagAwIBAgIBADANBgkqhkiG9w0BAQUFADBnMQswCQYDVQQGEwJVUzEV
>>
>> MBMGA1UECBMMUGVubnN5bHZhbmlhMRMwEQYDVQQHEwpQaXR0c2J1cmdoMREwDwYD
>>
>> VQQKEwhUZXN0U2hpYjEZMBcGA1UEAxMQaWRwLnRlc3RzaGliLm9yZzAeFw0wNjA4
>>
>> MzAyMTEyMjVaFw0xNjA4MjcyMTEyMjVaMGcxCzAJBgNVBAYTAlVTMRUwEwYDVQQI
>>
>> EwxQZW5uc3lsdmFuaWExEzARBgNVBAcTClBpdHRzYnVyZ2gxETAPBgNVBAoTCFRl
>>
>> c3RTaGliMRkwFwYDVQQDExBpZHAudGVzdHNoaWIub3JnMIIBIjANBgkqhkiG9w0B
>>
>> AQEFAAOCAQ8AMIIBCgKCAQEArYkCGuTmJp9eAOSGHwRJo1SNatB5ZOKqDM9ysg7C
>>
>> yVTDClcpu93gSP10nH4gkCZOlnESNgttg0r+MqL8tfJC6ybddEFB3YBo8PZajKSe
>>
>> 3OQ01Ow3yT4I+Wdg1tsTpSge9gEz7SrC07EkYmHuPtd71CHiUaCWDv+xVfUQX0aT
>>
>> NPFmDixzUjoYzbGDrtAyCqA8f9CN2txIfJnpHE6q6CmKcoLADS4UrNPlhHSzd614
>>
>> kR/JYiks0K4kbRqCQF0Dv0P5Di+rEfefC6glV8ysC8dB5/9nb0yh/ojRuJGmgMWH
>>
>> gWk6h0ihjihqiu4jACovUZ7vVOCgSE5Ipn7OIwqd93zp2wIDAQABo4HEMIHBMB0G
>>
>> A1UdDgQWBBSsBQ869nh83KqZr5jArr4/7b+QazCBkQYDVR0jBIGJMIGGgBSsBQ86
>>
>> 9nh83KqZr5jArr4/7b+Qa6FrpGkwZzELMAkGA1UEBhMCVVMxFTATBgNVBAgTDFBl
>>
>> bm5zeWx2YW5pYTETMBEGA1UEBxMKUGl0dHNidXJnaDERMA8GA1UEChMIVGVzdFNo
>>
>> aWIxGTAXBgNVBAMTEGlkcC50ZXN0c2hpYi5vcmeCAQAwDAYDVR0TBAUwAwEB/zAN
>>
>> BgkqhkiG9w0BAQUFAAOCAQEAjR29PhrCbk8qLN5MFfSVk98t3CT9jHZoYxd8QMRL
>>
>> I4j7iYQxXiGJTT1FXs1nd4Rha9un+LqTfeMMYqISdDDI6tv8iNpkOAvZZUosVkUo
>>
>> 93pv1T0RPz35hcHHYq2yee59HJOco2bFlcsH8JBXRSRrJ3Q7Eut+z9uo80JdGNJ4
>>
>> /SJy5UorZ8KazGj16lfJhOBXldgrhppQBb0Nq6HKHguqmwRfJ+WkxemZXzhediAj
>>
>> Geka8nz8JjwxpUjAiSWYKLtJhGEaTqCYxCCX2Dw+dOTqUzHOZ7WKv4JXPK5G/Uhr
>>
>> 8K/qhmFT2nIQi538n6rVYLeWj8Bbnl+ev0peYzxFyF5sQA==
>> </ds:X509Certificate>
>> </ds:X509Data>
>> </ds:KeyInfo>
>>
>> You might be looking at the encryption key, which corresponds to the SP
>> and also matches metadata.
>>
>> Thanks,
>> Nate.
>>
>> On Apr 18, 2013, at 0:15 , Yaowen Tu wrote:
>>
>> > Actually I meant that the Assertion is signed. It looks like
>> testshib.org is using a different certificate to sign the assertion.
>> >
>> > Thanks,
>> > Yaowen
>> >
>> > Yaowen
>> >
>> >
>> > On Wed, Apr 17, 2013 at 5:08 PM, Yaowen Tu <yaowen.tu at gmail.com> wrote:
>> > But the response returned to my SP is signed. In the Assertion object,
>> the isSigned() flag is true.
>> >
>> > Did I miss anything?
>> >
>> > Thanks,
>> > Yaowen
>> >
>> > Yaowen
>> >
>> >
>> > On Wed, Apr 17, 2013 at 4:48 PM, Cantor, Scott <cantor.2 at osu.edu>
>> wrote:
>> > On 4/17/13 7:35 PM, "Yaowen Tu" <yaowen.tu at gmail.com> wrote:
>> > >
>> > >From the SAMLResponse of the testshib.org <http://testshib.org> IdP,
>> it
>> > >contains a different certificate in the <Response> tag.
>> >
>> > I just looked at a response from it. Since it's not signing the
>> response,
>> > there is no certificate in it. So I would guess that given nothing would
>> > have changed, that you are probably mistaken about the issue.
>> >
>> > -- Scott
>> >
>> >
>> > --
>> > To unsubscribe from this list send an email to
>> users-unsubscribe at shibboleth.net
>> >
>> >
>> > --
>> > To unsubscribe from this list send an email to
>> users-unsubscribe at shibboleth.net
>>
>>
>> --
>> To unsubscribe from this list send an email to
>> users-unsubscribe at shibboleth.net
>>
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
>
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130418/bc9b30d6/attachment-0001.html
More information about the users
mailing list