Client certificate authentication failed for context issuer entity ID

[Brent Putman]

On 1/9/13 5:50 PM, Sean R. McNamara wrote:
> Hello all,
>
> We're running the Shibboleth IdP 2.1.2 and are members of incommon.  
> We've recently been trying to interoperate with a new SP and are
> running into issues with their attribute request.   The end result is
> an exception "Client certificate authentication failed for context
> issuer entity ID", but, it appears the real issue has to do with the
> line: "Failed to validate untrusted credential against trusted key"

Yes, exactly, that's the problem.

>
>
> 16:47:23.754 - DEBUG
> [org.opensaml.saml2.metadata.provider.AbstractMetadataProvider:206] -
> Searching for entity descriptor with an entity ID of
> https://Broken-SP/shibboleth
>
>
> 16:47:23.755 - DEBUG
> [org.opensaml.xml.security.keyinfo.BasicProviderKeyInfoCredentialResolver:296]
> - Processing KeyInfo child
> {http://www.w3.org/2000/09/xmldsig#}X509Data with provider
> org.opensaml.xml.security.keyinfo.provider.InlineX509DataProvider
>
> 16:47:23.756 - DEBUG
> [org.opensaml.xml.security.keyinfo.provider.InlineX509DataProvider:122] -
> Attempting to extract credential from an X509Data
>
> 16:47:23.763 - DEBUG
> [org.opensaml.xml.security.keyinfo.provider.InlineX509DataProvider:195] -
> Found 1 X509Certificates
>
> 16:47:23.763 - DEBUG
> [org.opensaml.xml.security.keyinfo.provider.InlineX509DataProvider:176] -
> Found 0 X509CRLs
>
> 16:47:23.763 - DEBUG
> [org.opensaml.xml.security.keyinfo.provider.InlineX509DataProvider:214] -
> Single certificate was present, treating as end-entity certificate
>

> 16:47:23.764 - DEBUG
> [org.opensaml.xml.security.keyinfo.BasicProviderKeyInfoCredentialResolver:301]
> - Credentials successfully extracted from child
> {http://www.w3.org/2000/09/xmldsig#}X509Data by provider
>



Looks like the metadata you have for the Broken-SP has 1 certificate in
metadata.



>
> 16:47:23.766 - DEBUG
> [org.opensaml.xml.security.trust.ExplicitKeyTrustEvaluator:94] -
> Failed to validate untrusted credential against trusted key
>


This line however indicates that the metadata cert's public key does not
match the public key in the client cert being presented during client TLS. 

So, either the SP is using the wrong cert with your IdP, or the metadata
is out-of-date.  Take your pick, but that's the basic problem. 




-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130109/2ee897eb/attachment.html