Client certificate authentication failed for context issuer entity ID

[Sean R. McNamara]

Thank you, Brent.  That's where I was leaning too, but, it helps to have a more experienced set of eyes of validate my thinking.   My metadata is up to date, so, I'm guessing the SP is using the wrong certificate.

Thanks again,

..Sean.

From: Brent Putman <putmanb at georgetown.edu<mailto:putmanb at georgetown.edu>>
Reply-To: Shib Users <users at shibboleth.net<mailto:users at shibboleth.net>>
Date: Wed, 9 Jan 2013 18:10:32 -0500
To: <users at shibboleth.net<mailto:users at shibboleth.net>>
Subject: Re: Client certificate authentication failed for context issuer entity ID


On 1/9/13 5:50 PM, Sean R. McNamara wrote:
Hello all,

We're running the Shibboleth IdP 2.1.2 and are members of incommon.   We've recently been trying to interoperate with a new SP and are running into issues with their attribute request.   The end result is an exception "Client certificate authentication failed for context issuer entity ID", but, it appears the real issue has to do with the line: "Failed to validate untrusted credential against trusted key"

Yes, exactly, that's the problem.




16:47:23.754 - DEBUG [org.opensaml.saml2.metadata.provider.AbstractMetadataProvider:206] - Searching for entity descriptor with an entity ID of https://Broken-SP/shibboleth


16:47:23.755 - DEBUG [org.opensaml.xml.security.keyinfo.BasicProviderKeyInfoCredentialResolver:296] - Processing KeyInfo child {http://www.w3.org/2000/09/xmldsig#}X509Data with provider org.opensaml.xml.security.keyinfo.provider.InlineX509DataProvider

16:47:23.756 - DEBUG [org.opensaml.xml.security.keyinfo.provider.InlineX509DataProvider:122] - Attempting to extract credential from an X509Data

16:47:23.763 - DEBUG [org.opensaml.xml.security.keyinfo.provider.InlineX509DataProvider:195] - Found 1 X509Certificates

16:47:23.763 - DEBUG [org.opensaml.xml.security.keyinfo.provider.InlineX509DataProvider:176] - Found 0 X509CRLs

16:47:23.763 - DEBUG [org.opensaml.xml.security.keyinfo.provider.InlineX509DataProvider:214] - Single certificate was present, treating as end-entity certificate


16:47:23.764 - DEBUG [org.opensaml.xml.security.keyinfo.BasicProviderKeyInfoCredentialResolver:301] - Credentials successfully extracted from child {http://www.w3.org/2000/09/xmldsig#}X509Data by provider



Looks like the metadata you have for the Broken-SP has 1 certificate in metadata.





16:47:23.766 - DEBUG [org.opensaml.xml.security.trust.ExplicitKeyTrustEvaluator:94] - Failed to validate untrusted credential against trusted key


This line however indicates that the metadata cert's public key does not match the public key in the client cert being presented during client TLS.

So, either the SP is using the wrong cert with your IdP, or the metadata is out-of-date.  Take your pick, but that's the basic problem.




-- To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net<mailto:users-unsubscribe at shibboleth.net>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130109/815b1d94/attachment.html