Cert error

[Stein, Eric]

The root cause was this:
  shibboleth2.xml was loading both the client's test metadata and the client's production metadata. Both metadata files had the same entityId. It appears in that situation shibboleth just hits the first one that's listed, which was the test metadata in our case. That caused accesses from their test IdP to work but their live IdP to fail.

The moral of the story appears to be "make sure all your metadata files have different entityIds".

Eric

-----Original Message-----
From: Stein, Eric 
Sent: Thursday, August 01, 2013 2:22 PM
To: users at shibboleth.net
Subject: Cert error

I have a client using RSA's FIM as their IdP to connect to our Shibboleth SP. They gave us a copy of their metadata, and we reference it from shibboleth2.xml. When they try to log in to our system, they get the error message "Message was signed, but signature could not be verified." In the logs, the issue appears to be that the certificate name is not acceptable.

My client insists that this is an issue on our end, and that we *must* need to have their certificate file somewhere for the SP to read from. I did a lot of searching on this issue. My understanding is that this is a problem between their cert and their IdP, and that Shibboleth doesn't need their cert at all - it works from the metadata.

I guess my question is: is there any possible configuration issue on the SP side (Apache or the SP itself) which could be generating this error? Or is this 100% on the IdP side?

Thanks,
Eric

shibd.log:
2013-08-01 10:07:05 DEBUG OpenSAML.MessageDecoder.SAML2 [1]: extracting issuer from SAML 2.0 protocol message
2013-08-01 10:07:05 DEBUG OpenSAML.MessageDecoder.SAML2 [1]: message from (<<client name>>)
2013-08-01 10:07:05 DEBUG OpenSAML.MessageDecoder.SAML2 [1]: searching metadata for message issuer...
2013-08-01 10:07:05 DEBUG OpenSAML.SecurityPolicyRule.MessageFlow [1]: evaluating message flow policy (replay checking on, expiration 60)
2013-08-01 10:07:05 DEBUG XMLTooling.StorageService [1]: inserted record (e8ab05026dced2ae23d4e11688fd3cc4) in context (MessageFlow) with expiration (1375377118)
2013-08-01 10:07:05 DEBUG OpenSAML.SecurityPolicyRule.XMLSigning [1]: validating signature profile
2013-08-01 10:07:05 DEBUG XMLTooling.CredentialCriteria [1]: keys didn't match
2013-08-01 10:07:05 DEBUG XMLTooling.TrustEngine.ExplicitKey [1]: unable to validate signature, no credentials available from peer
2013-08-01 10:07:05 DEBUG XMLTooling.TrustEngine.PKIX [1]: validating signature using certificate from within the signature
2013-08-01 10:07:05 DEBUG XMLTooling.TrustEngine.PKIX [1]: signature verified with key inside signature, attempting certificate validation...
2013-08-01 10:07:05 DEBUG XMLTooling.TrustEngine.PKIX [1]: checking that the certificate name is acceptable
2013-08-01 10:07:05 DEBUG XMLTooling.TrustEngine.PKIX [1]: adding to list of trusted names (<<client name>>)
2013-08-01 10:07:05 DEBUG XMLTooling.TrustEngine.PKIX [1]: certificate subject: CN=federate.<<client name>>.com,OU=<<client name>>,O=<<client name>> Company,L=<<client city>>,ST=<<client state>>,C=<<client country>>
2013-08-01 10:07:05 DEBUG XMLTooling.TrustEngine.PKIX [1]: unable to match DN, trying TLS subjectAltName match
2013-08-01 10:07:05 DEBUG XMLTooling.TrustEngine.PKIX [1]: unable to match subjectAltName, trying TLS CN match
2013-08-01 10:07:05 ERROR XMLTooling.TrustEngine.PKIX [1]: certificate name was not acceptable
2013-08-01 10:07:05 ERROR OpenSAML.SecurityPolicyRule.XMLSigning [1]: unable to verify message signature with supplied trust engine

native.log:
2013-08-01 10:07:45 DEBUG Shibboleth.Apache [4264] shib_check_user: mapped https://<<our server>>/<<our application>> to default
2013-08-01 10:07:45 DEBUG Shibboleth.SessionInitiator.SAML2 [4264] shib_check_user: attempting to initiate session using SAML 2.0 with provider (https://<<our server>>/idp/shibboleth)
2013-08-01 10:07:45 DEBUG Shibboleth.Listener [4264] shib_check_user: sending message (default/Login::run::SAML2SI)
2013-08-01 10:07:45 DEBUG Shibboleth.Listener [4264] shib_check_user: send completed, reading response message
2013-08-01 10:08:02 DEBUG Shibboleth.Apache [4264] shib_handler: mapped https://<<our server> /Shibboleth.sso/SAML2/POST to default
2013-08-01 10:08:02 DEBUG Shibboleth.Listener [4264] shib_handler: sending message (default/SAML2/POST)
2013-08-01 10:08:02 DEBUG Shibboleth.Listener [4264] shib_handler: send completed, reading response message
2013-08-01 10:08:03 ERROR Shibboleth.Listener [4264] shib_handler: remoted message returned an error: Message was signed, but signature could not be verified.
2013-08-01 10:08:03 ERROR Shibboleth.Apache [4264] shib_handler: Message was signed, but signature could not be verified.
2013-08-01 10:08:03 DEBUG Shibboleth.Apache [4264] shib_handler: mapped https://<<our server>>/shibboleth-sp/main.css to default