Signature trust could not be established via PKIX validation of signing credential

[Schumacher, Adam J.]

Just in case anyone stumbles across this thread in the future, I finally managed to get it solved.  It was, of course, an issue with the SP's metadata.  

What they had:

<md:KeyDescriptor>
        <X509Data xmlns="http://www.w3.org/2000/09/xmldsig#">
          <X509Certificate>
        [cert data here]
          </X509Certificate>
        </X509Data>
    </md:KeyDescriptor>

What they should have had (notice the addition of the KeyInfo element):

<md:KeyDescriptor>
      <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
        <ds:X509Data >
          <ds:X509Certificate>
          [cert data here]
                    </ds:X509Certificate>
        </ds:X509Data>
      </ds:KeyInfo>
    </md:KeyDescriptor>

I finally noticed the problem when looking at the examples in https://wiki.shibboleth.net/confluence/display/SHIB2/MetadataKeyDescriptor.  Lessons learned: RTFM.  I'm still going to blame the SP though, since it was their metadata. :D

::Adam

> -----Original Message-----
> From: users-bounces at shibboleth.net [mailto:users-
> bounces at shibboleth.net] On Behalf Of Cantor, Scott
> Sent: Thursday, July 11, 2013 16:42
> To: Shib Users
> Subject: RE: Signature trust could not be established via PKIX validation of
> signing credential
> 
> > My logs look almost exactly the same as yours except the references to
> > PKIX vs ExplicitKey.  I restarted the IDP and captured the logs on
> > startup to see if it is loading that trust engine, and from what I can
> > tell it appears to at least be parsing the config for it:
> 
> Yeah, that matches, but something's obviously wrong. If the logs don't show
> it falling through the first trust engine that's enough to explain the result you
> get, if not why.
> 
> -- Scott
> 
> 
> --
> To unsubscribe from this list send an email to users-
> unsubscribe at shibboleth.net