unsigned authN requests

[Brent Putman]

On 6/5/13 8:08 PM, David Bantz wrote:
>
> 15:51:40.647 - DEBUG [org.opensaml.xml.signature.impl.ExplicitKeySignatureTrustEngine:154] - Attempting to verify signature using trusted credentials
> 15:51:40.647 - DEBUG [org.opensaml.xml.signature.impl.ExplicitKeySignatureTrustEngine:162] - Failed to verify signature using either supplied candidate credential or directly trusted credentials
> 15:51:40.647 - DEBUG [org.opensaml.xml.signature.impl.PKIXSignatureTrustEngine:171] - Candidate credential was either not supplied or did not contain verification key
> 15:51:40.648 - DEBUG [org.opensaml.xml.signature.impl.PKIXSignatureTrustEngine:172] - PKIX trust engine requires supplied key, skipping PKIX trust evaluation
> 15:51:40.648 - WARN [org.opensaml.common.binding.security.BaseSAMLSimpleSignatureSecurityPolicyRule:195] - Simple signature validation (with no request-derived credentials) failed
> 15:51:40.648 - WARN [org.opensaml.common.binding.security.BaseSAMLSimpleSignatureSecurityPolicyRule:138] - Validation of request simple signature failed for context issuer: https://demo.docusign.net
> 15:51:40.649 - WARN [edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler:377] - Message did not meet security requirements
>


Just wanted to point out that this logging indicates it's trying to verify a simple/blob signature,
not an XML signature on the AuthnRequest, so presumably an HTTP Redirect DEFLATE binding (unless
they gasp have implemented POST SimpleSign).  Earlier in the debug logging it should say for sure. 

May or may not be helpful to your troubleshooting.  But if this is the case then you won't see an
XML signature if you e.g. look at the AuthnRequest in the PROTOCOL_MESSAGE log entries, or in FF
SAMLTracer, although the latter can show you the URL or POST parameters  obviously (look for a param
called 'Signature' IIRC).