Re: Shibboleth SP -- "opensaml::FatalProfileException"

[Kevin P. Foote]

What are the permissions on your key file? Can the user that shibd is running as read the file?

sent from mobile

----- Reply message -----
From: "Aravindhan A" <apitest4 at gmail.com>
To: <users at shibboleth.net>
Subject: Shibboleth SP -- "opensaml::FatalProfileException"
Date: Fri, Aug 30, 2013 2:52 AM


Hi Scott,

 I cheked the shibd.log files , which shows the error "failed to decrypt
assertion: Unable to resolve any key decryption keys".

I checked the common troubleshooting errors, which shows "Metadata not
contains the same public key SP is configured to use".

I checked the metadata file for SPSSODescriptor , which is fine(content of
/etc/shibboleth/sp-cert.pem). But it still shows the error.

I  have noticed that there is a error while restarting the shibd service ,

"2013-08-30 12:01:47 INFO Shibboleth.AttributeExtractor.XML : creating
mapping for Attribute urn:mace:dir:attribute-def:eduPersonEntitlement
2013-08-30 12:01:47 INFO Shibboleth.AttributeExtractor.XML : creating
mapping for Attribute urn:oid:1.3.6.1.4.1.5923.1.1.1.7
2013-08-30 12:01:47 INFO Shibboleth.AttributeExtractor.XML : creating
mapping for Attribute urn:mace:dir:attribute-def:eduPersonTargetedID
2013-08-30 12:01:47 INFO Shibboleth.AttributeExtractor.XML : creating
mapping for Attribute urn:oid:1.3.6.1.4.1.5923.1.1.1.10
2013-08-30 12:01:47 INFO Shibboleth.AttributeExtractor.XML : creating
mapping for Attribute urn:oasis:names:tc:SAML:2.0:nameid-format:persistent
2013-08-30 12:01:47 INFO Shibboleth.Application : building AttributeFilter
of type XML...
2013-08-30 12:01:47 DEBUG Shibboleth.AttributeFilter : using local resource
(/etc/shibboleth/attribute-policy.xml), will monitor for changes
2013-08-30 12:01:47 DEBUG Shibboleth.AttributeFilter : loading configuration
from external resource...
2013-08-30 12:01:47 INFO Shibboleth.AttributeFilter : reload thread
started...running when signaled
2013-08-30 12:01:47 INFO Shibboleth.AttributeFilter : loaded XML resource
(/etc/shibboleth/attribute-policy.xml)
2013-08-30 12:01:47 INFO Shibboleth.Application : building AttributeResolver
of type Query...
2013-08-30 12:01:47 INFO Shibboleth.Application : building
CredentialResolver of type File...
2013-08-30 12:01:47 INFO XMLTooling.SecurityHelper : loading private key
from file (/etc/shibboleth/sp-key.pem)
2013-08-30 12:01:47 ERROR OpenSSL : error code: 33558541 in bss_file.c, line
398
2013-08-30 12:01:47 ERROR OpenSSL : error data:
fopen('/etc/shibboleth/sp-key.pem','r')
2013-08-30 12:01:47 ERROR OpenSSL : error code: 537346050 in bss_file.c,
line 400
2013-08-30 12:01:47 CRIT Shibboleth.Application : error building
CredentialResolver: Unable to load private key from file
(/etc/shibboleth/sp-key.pem).
2013-08-30 12:01:47 INFO Shibboleth.Listener : registered remoted message
endpoint (default::getHeaders::Application)
2013-08-30 12:01:47 INFO Shibboleth.Listener : listener service starting
"

Which indicates the private key is not loaded correctly, But I tried
regenerating the SP key file using keygen.sh , While using new certificated
also , it shows the same error in UI and it contains the same error while
restarting the shibd service.

I tried adding the IDP private key and the certificates in the credential
resolver of the shibboleth2.xml. But that also shows the same error.

I attached the shibd.log and shibboleth2.xml files for reference.

shibboleth2.xml
<http://shibboleth.1660669.n2.nabble.com/file/n7589665/shibboleth2.xml>  
shibd.log <http://shibboleth.1660669.n2.nabble.com/file/n7589665/shibd.log>  

How can i resolve this?

--Aravindhan A




--
View this message in context: http://shibboleth.1660669.n2.nabble.com/Shibboleth-SP-opensaml-FatalProfileException-tp7589643p7589665.html
Sent from the Shibboleth - Users mailing list archive at Nabble.com.
--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130830/a0a7eea2/attachment-0001.html