Yet another Idp error after SP upgrade

[Mike Flynn]

Comparing the metadata generated from my old server and the new server, I see this in the new:

  <md:Extensions xmlns:alg="urn:oasis:names:tc:SAML:metadata:algsupport">
    <alg:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha512"/>
    <alg:DigestMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#sha384"/>
    <alg:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
    <alg:DigestMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#sha224"/>
    <alg:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
    <alg:SigningMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha512"/>
    <alg:SigningMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha384"/>
    <alg:SigningMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha256"/>
    <alg:SigningMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha224"/>
    <alg:SigningMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha512"/>
    <alg:SigningMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha384"/>
    <alg:SigningMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/>
    <alg:SigningMethod Algorithm="http://www.w3.org/2009/xmldsig11#dsa-sha256"/>
    <alg:SigningMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha1"/>
    <alg:SigningMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
    <alg:SigningMethod Algorithm="http://www.w3.org/2000/09/xmldsig#dsa-sha1"/>
  </md:Extensions>

Which is not an issue for most IDPs but it appears that Ping has an issue with this.


________________________________
 From: Mike Flynn <shibbolethlynda at yahoo.com>
To: Shib Users <users at shibboleth.net> 
Sent: Monday, August 12, 2013 8:25 AM
Subject: Re: Yet another Idp error after SP upgrade
 


Understood.  Thanks, Scott.


________________________________
 From: "Cantor, Scott" <cantor.2 at osu.edu>
To: Shib Users <users at shibboleth.net> 
Sent: Monday, August 12, 2013 8:16 AM
Subject: Re: Yet another Idp error after SP upgrade
 

On 8/12/13 10:55 AM, "Mike Flynn" <shibbolethlynda at yahoo.com> wrote:

>No keys have changed at this point.  All metadata files, .cer/.pem files
>were brought over from the old servers in their entirety and now
>including the original working config file.

If the key didn't change, then the entityID did. Nothing else can cause
that error (assuming it was working before).

What you do now has no impact on the metadata they have. And that metadata
is wrong for the configuration you now have, which means either the
metadata changed or your entityID and/or key did. That is not in dispute
here, it's just a fact.

-- Scott


--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net



--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130812/8f11192f/attachment.html