Yet another Idp error after SP upgrade

[Paul Hethmon]

Mike,

That's your configuration, not what the IdP is saying is the error. While you're getting back a SAML error message, it's likely that the IdP has more detailed information about exactly what they didn't like to generate that message. You need to trace the flow of what's happening here. You've repeatedly stated that nothing has changed on your side, so prove it. You're signing the requests as indicated by your configuration. Capture the actual SAML AuthnRequest sent to that IdP. Verify the signature using a tool against the key that you believe to be used. That's a pretty simple check. The stuff going over the wire never lies.

Paul


From: Mike Flynn <shibbolethlynda at yahoo.com<mailto:shibbolethlynda at yahoo.com>>
Reply-To: Shibboleth Users <users at shibboleth.net<mailto:users at shibboleth.net>>
Date: Monday, August 12, 2013 2:24 PM
To: Shibboleth Users <users at shibboleth.net<mailto:users at shibboleth.net>>
Subject: Re: Yet another Idp error after SP upgrade

It varies depending on the IDp but it looks like authN signing is not working...

In my config I have this:

<RelyingParty Name="usjoneslanglasalle:default:entityid" signing ="true"/>
<RelyingParty Name="MWG:PRO:Lynda:SAML2:IdP" signing ="true"/>
<RelyingParty Name="https://fed.erau.edu/fed/idp" signing ="true"/>
<RelyingParty Name="http://adfs.engauge.com/adfs/services/trust" signing ="true"/>
<RelyingParty Name="http://login.oliverwymangroup.com/adfs/services/trust" signing ="true"/>
<RelyingParty Name="https://adfs.gmcr.com/adfs/services/trust" signing ="true"/>
<RelyingParty Name="http://studentfs.studygroup.com/adfs/services/trust" signing ="true"/>
<RelyingParty Name="http://fs.dolby.com/adfs/services/trust" signing ="true"/>
<RelyingParty Name="ping.mbopartners.com:saml2" signing ="true"/>
<RelyingParty Name="localhost:default:entityId" signing ="true"/>

Worked fine on the old system and shibd -check does not complain about them...

________________________________
From: Paul Hethmon <paul.hethmon at clareitysecurity.com<mailto:paul.hethmon at clareitysecurity.com>>
To: Shib Users <users at shibboleth.net<mailto:users at shibboleth.net>>
Sent: Monday, August 12, 2013 11:16 AM
Subject: Re: Yet another Idp error after SP upgrade

Have you asked the IdP for the details of the error they are sending you? Perhaps that would help find the source.

Paul


From: Mike Flynn <shibbolethlynda at yahoo.com<mailto:shibbolethlynda at yahoo.com>>
Reply-To: Shibboleth Users <users at shibboleth.net<mailto:users at shibboleth.net>>
Date: Monday, August 12, 2013 2:14 PM
To: Shibboleth Users <users at shibboleth.net<mailto:users at shibboleth.net>>
Subject: Re: Yet another Idp error after SP upgrade

Well, you folks are saying that I changed an entityID etc to cause this error - but like I said - I copied etc verbatim.  No change....  Only certain IDps are failing (and still failing now).  In the logs I am getting things like this:


--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net<mailto:users-unsubscribe at shibboleth.net>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130812/7f5dc3fa/attachment.html