Signature trust could not be established via PKIX validation of signing credential

[Schumacher, Adam J.]

> How is the metadata supplied to the IdP?
> 
Originally, it was FileBackedHTTPMetadataProvider with the metadata signed, etc.  However, as part of troubleshooting and to simplify things, I removed the signature parts and switched it to FilesystemMetadataProvider so that I could make changes myself and see if they make a difference.

> >         <X509SubjectName>CN=ip-0A420AEF</X509SubjectName>
> 
> Just for kicks, take that out.
> 
Done.  No change.  I had added that myself (it wasn't in the original metadata given to me by the SP) for testing.  

> > > You can certainly turn up org.opensaml and see what it tells you.
> > >
> > It was already at TRACE and the logs I pasted previously are all it gave me.
> 
> You have org.opensaml at DEBUG?
> 
Yup.

> When I had logging up, I intentionally created a mismatch and see this stuff
> before any PKIX stuff gets involved. You can see the references to
> ExplicitKeySignatureTrustEngine, which is what has to be in there. If you
> don't see that, then somehow it's not enabled despite your configuration.
> 
My logs look almost exactly the same as yours except the references to PKIX vs ExplicitKey.  I restarted the IDP and captured the logs on startup to see if it is loading that trust engine, and from what I can tell it appears to at least be parsing the config for it:

12:40:34.017 - INFO [edu.internet2.middleware.shibboleth.common.config.security.ChainingSignatureTrustEngineBeanDefinitionParser:59] - Parsing configuration for SignatureChaining trust engine with id: shibboleth.SignatureTrustEngine
12:40:34.018 - DEBUG [edu.internet2.middleware.shibboleth.common.config.security.ChainingSignatureTrustEngineBeanDefinitionParser:68] - Parsing chain trust engine member shibboleth.SignatureTrustEngine
12:40:34.020 - INFO [edu.internet2.middleware.shibboleth.common.config.security.MetadataExplicitKeySignatureTrustEngineBeanDefinitionParser:50] - Parsing configuration for MetadataExplicitKeySignature trust engine with id: shibboleth.SignatureMetadataExplicitKeyTrustEngine
12:40:34.021 - DEBUG [edu.internet2.middleware.shibboleth.common.config.security.ChainingSignatureTrustEngineBeanDefinitionParser:68] - Parsing chain trust engine member shibboleth.SignatureTrustEngine
12:40:34.023 - INFO [edu.internet2.middleware.shibboleth.common.config.security.MetadataPKIXSignatureTrustEngineBeanDefinitionParser:52] - Parsing configuration for MetadataPKIXSignature trust engine with id: shibboleth.SignatureMetadataPKIXTrustEngine
12:40:34.025 - INFO [edu.internet2.middleware.shibboleth.common.config.security.ChainingTrustEngineBeanDefinitionParser:59] - Parsing configuration for Chaining trust engine with id: shibboleth.CredentialTrustEngine
12:40:34.026 - DEBUG [edu.internet2.middleware.shibboleth.common.config.security.ChainingTrustEngineBeanDefinitionParser:68] - Parsing chain trust engine member shibboleth.CredentialTrustEngine
12:40:34.028 - INFO [edu.internet2.middleware.shibboleth.common.config.security.MetadataExplicitKeyTrustEngineBeanDefinitionParser:48] - Parsing configuration for MetadataExplicitKey trust engine with id: shibboleth.CredentialMetadataExplictKeyTrustEngine
12:40:34.029 - DEBUG [edu.internet2.middleware.shibboleth.common.config.security.ChainingTrustEngineBeanDefinitionParser:68] - Parsing chain trust engine member shibboleth.CredentialTrustEngine
12:40:34.030 - INFO [edu.internet2.middleware.shibboleth.common.config.security.MetadataPKIXX509CredentialTrustEngineBeanDefinitionParser:52] - Parsing configuration for MetadataPKIXX509Credential trust engine with id: shibboleth.CredentialMetadataPKIXTrustEngine



::Adam