SP Error: Message was signed, but signature could not be verified

[Cantor, Scott]

On 6/5/13 2:13 PM, "Jeff Gehly" <gehly_jeffrey at bah.com> wrote:

>Near as I can tell, the rejection happens when the load balancer sends the
>whole request through server B instead of server A.  I would say that it's
>likely the servers have different certificates because they reside on
>separate physical hardware and are configured to run independent of each
>other.

Well, if they use different signing keys, I suppose that would be
possible. But that's a pretty unusual mistake, so it isn't all that likely.

Other than that, I can think of no other explanation.

>Since this seems to be the case, how do I configure Shibboleth to trust
>both
>servers so that it doesn't think there's a spoof happening?

If they use different keys, then the metadata is wrong and needs to carry
both. If not, I have to dispute your observations given what I know.

You would have to look into the log, identify what exactly is wrong, and
probably debug the XML Signature itself, which is extremely difficult to
do. The wiki includes some information on that, and current releases of
the stack have some better logging tools for directing signature
verification logs to catch the octets being digested.

-- Scott