SP Error: Message was signed, but signature could not be verified

[Jeff Gehly]

I have checked the troubleshooting and even the mailing list, but nothing
matched my conditions exactly so I'm looking to see if I should be
investigating the IdP or the SP for the source of the problem.


This what the setup looks like:  There is are two WebLogic managed servers
sitting behind a load balancer.  There is just a single Shibboleth SP.

The load balancer may route the request through either managed server.  Both
could therefore end up as the IdP, even though only one of the servers is
the actual IdP.  This sounds like it falls into the 3rd category on the
troubleshooting list (accidental spoofing of an IdP), but there are 2 things
that have me confused:

1)  Assertion signing is disabled on both the IdP and SP so I don't know why
the SP is even checking the signature right now
2)  It actually works within the network the IdP and SP reside on, but when
accessed from an external network it throws this error.


I think this is an IdP problem, but I want to double-check that I'm correct
to take Shibboleth SP off the list of potential suspects.



--
View this message in context: http://shibboleth.1660669.n2.nabble.com/SP-Error-Message-was-signed-but-signature-could-not-be-verified-tp7587180.html
Sent from the Shibboleth - Users mailing list archive at Nabble.com.