Internation dateline issue

[Mike Flynn]

Well, that issue magically resolved itself...

Now it looks like a cert issue...

We run shibboleth 2.3.0
> 
>The ‘instant expiration’ error seems to have gone away and now we are seeing the following error:
> 
>08:11:09.982 - WARN [org.opensaml.common.binding.security.BaseSAMLSimpleSignatureSecurityPolicyRule:195] - Simple signature validation (with no request-derived credentials) failed
>08:11:09.982 - WARN [org.opensaml.common.binding.security.BaseSAMLSimpleSignatureSecurityPolicyRule:138] - Validation of request simple signature failed for context issuer:https://shib.lynda.com/shibboleth-sp
>08:11:09.984 - WARN [edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler:348] - Message did not meet security requirements
>org.opensaml.ws.security.SecurityPolicyException: Validation of request simple signature failed for context issuer
> 
>I have checked that metadata is up to date and that Lynda.com is listed as a SP.
> 
>No issues have been reported as far as using AAF federated resources. I’m not sure if anyone here has used an overseas SP.

We joined the AAF and as part of that process, the AAF required that we create a new cert that used our entityID instead of our base domain.  So, I created a new one:

        <CredentialResolver type="Chaining">
        <!-- 
             Certificate/Private key pairs are read in sequence.
             Unless specificially defined only the first 
             CredentialResolver is used for attribute requests.
        -->
             <CredentialResolver type="File" keyName="Active" use="encryption"
                                 key="C:\opt\shibboleth-sp\etc\shibboleth\sp-key-2011.pem" 
                                 certificate="C:\opt\shibboleth-sp\etc\shibboleth\sp-cert-2011.pem"/>
             <CredentialResolver type="File" keyName="Standby" 
                                 key="C:\opt\shibboleth-sp\etc\shibboleth\sp-key.pem" 
                                 certificate="C:\opt\shibboleth-sp\etc\shibboleth\sp-cert.pem"/>
             <CredentialResolver type="File" keyName="AAF" 
                                 key="C:\opt\shibboleth-sp\etc\shibboleth\sp-key-AAF.pem" 
                                 certificate="C:\opt\shibboleth-sp\etc\shibboleth\sp-cert-AAF.pem"/>
        </CredentialResolver>

Regenerated my metadata and gave that to the AAF.  Got theirs and their cert. Load em up, no problem. 

Obviously the cert is my first suspect in this - Anyone care to venture what to look at?  I have verified that my metadata has the correct AAF cert in it.  The AAF also has mine correctly.  Where else can I look?

________________________________
 From: "Cantor, Scott" <cantor.2 at osu.edu>
To: Shib Users <users at shibboleth.net> 
Sent: Tuesday, January 22, 2013 11:36 AM
Subject: Re: Internation dateline issue
 
On 1/22/13 2:30 PM, "Mike Flynn" <shibbolethlynda at yahoo.com> wrote:

>And just to clarify - On the SP side, my setting of clockSkew="180" is
>just to allow a 3 minute variance in the UTC for inbound only, correct?
>No impact on outbound?

Yes, has nothing to do with what you generate.

-- Scott


--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130122/64096d6b/attachment-0001.html