Yet another Idp error after SP upgrade

[Mike Flynn]

Hmmm.

Without changing any of the files I copied the etc folder from my old working system to production so I have not changed anything in this config as it sits.  If the upgrade cannot change the metadata, when where did this stanza come from on the new server?


  <md:Extensions xmlns:alg="urn:oasis:names:tc:SAML:metadata:algsupport">
    <alg:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha512"/>
    <alg:DigestMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#sha384"/>
    <alg:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
    <alg:DigestMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#sha224"/>
    <alg:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
    <alg:SigningMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha512"/>
    <alg:SigningMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha384"/>
    <alg:SigningMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha256"/>
    <alg:SigningMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha224"/>
    <alg:SigningMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha512"/>
    <alg:SigningMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha384"/>
    <alg:SigningMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/>
    <alg:SigningMethod Algorithm="http://www.w3.org/2009/xmldsig11#dsa-sha256"/>
    <alg:SigningMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha1"/>
    <alg:SigningMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
    <alg:SigningMethod Algorithm="http://www.w3.org/2000/09/xmldsig#dsa-sha1"/>
  </md:Extensions>


________________________________
 From: "Cantor, Scott" <cantor.2 at osu.edu>
To: Shib Users <users at shibboleth.net> 
Sent: Monday, August 12, 2013 10:22 AM
Subject: Re: Yet another Idp error after SP upgrade
 

On 8/12/13 1:11 PM, "Mike Flynn" <shibbolethlynda at yahoo.com> wrote:

>Well, I only pulled it (Shibboleth.sso/Metadata) from each box to compare
>them.

In isolation, that isn't consistent with the breakage you've experienced,
so something else is involved. Almost certainly the metadata being
consumed is improper somewhere, but for things to break like this, you
have to have changed keys or entityIDs or some sort of custom behavior
that was in place for an IdP. It can't be operationally behaving the same,
obviously.

My other point was that in the event that Ping has a bug, it's not of any
immediate consequence and isn't anything somebody should have seen anyway
just because of the upgrade. For that to happen, the actual metadata
consumed has to change and it should never change because of an upgrade
alone without it being pulled directly with no intervening process.

-- Scott


--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130812/2b80f067/attachment.html