SP Error: Message was signed, but signature could not be verified

[Nate Klingenstein]

Or, I suppose the message could be getting mangled somehow in one of the network/IdP hosting configurations, causing the signature to legitimately fail verification.  Still, the SP's shibd.log should allow you to determine where, if not why, things are broken.

On Jun 3, 2013, at 13:44 , Nate Klingenstein wrote:

1)  Assertion signing is disabled on both the IdP and SP so I don't know why
the SP is even checking the signature right now

The response(as opposed to the assertion) might be getting signed too.  Have you looked at the inbound assertion to inspect for signatures?  The SP will log the response and the decrypted assertion with shibd.logger on DEBUG.

2)  It actually works within the network the IdP and SP reside on, but when
accessed from an external network it throws this error.

My guess would be the IdP's are using different signature keys, and a user is being assigned to an IdP based on network location.

But yes, I agree, this is probably an IdP problem.
--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net<mailto:users-unsubscribe at shibboleth.net>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130603/22badc8e/attachment.html