SP Error: Message was signed, but signature could not be verified

[Cantor, Scott]

On 6/5/13 4:34 PM, "Jeff Gehly" <gehly_jeffrey at bah.com> wrote:

>Shibboleth is definitely a nice SP, but debugging problems in the SSO can
>be a very
> confusing and challenging process, particularly when it's not always
>known whether the
>problem originates on the SP or IdP side.

That describes virtually every non-trivial problem in any SSO exchange
that involves cryptography or URL validation. It isn't possible to know in
most cases.

But I'm always happy to see suggestions filed for improving log messages.
Right now, they allow me to diagnose most errors in a few minutes. I don't
know how to take them beyond that point.

(That's an SP comment, BTW, there are a number of issues I have with the
IdP logs.)

-- Scott