Yet another Idp error after SP upgrade

[Mike Flynn]

All keys are back in place.  I did that yesterday.  I think the issue is indeed signed requests since I had a customer do an IDP initiated and that worked but SP init did not...


________________________________
 From: "Cantor, Scott" <cantor.2 at osu.edu>
To: Shib Users <users at shibboleth.net> 
Sent: Monday, August 12, 2013 11:26 AM
Subject: Re: Yet another Idp error after SP upgrade
 

On 8/12/13 2:14 PM, "Mike Flynn" <shibbolethlynda at yahoo.com> wrote:

>Well, you folks are saying that I changed an entityID etc to cause this
>error - but like I said - I copied etc verbatim.  No change....  Only
>certain IDps are failing (and still
> failing now).

Then it couldn't have worked before, at least based on the errors claimed.
If it was a case of some kind of TLS stack issue, then sure, I could
imagine an upgrade causing something, but not audience errors or signed
redirect failures, or decryption failures.

>In the logs I am getting things like this:
>
>
>2013-08-12 08:46:44 ERROR OpenSAML.SOAPClient [7]: SOAP client detected a
>SAML error: (saml1p:Responder) (Message did not meet security
>requirements)
>2013-08-12 08:46:44 ERROR Shibboleth.AttributeResolver.Query [7]:
>attribute authority returned a SAML error

Also a sign the entityID or key changed, generally the latter.

You've already said at an earlier point in this thread that you had
multiple keys and removed one. I can't say when you did it, but it seems
like that's clearly the issue. I think you had both keys active,
apparently being used in special circumstances, and then you dropped one
and had IdPs stuck on old metadata (possibly due to their own malfeasance
in keeping metadata updated) and now it fails because you switched off the
old key.

That is the most straightforward change that explains most of this
behavior.

-- Scott


--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130812/f9160e7f/attachment-0001.html