Centralized Discovery Service: problem with <ds:signature>

[Pascal Panneels]

Hi,

It is already a year now that I've setup the Shibboleth Centralized DS
and it has been working well so far.

We are now encountering some problems with new SP connecting to our
federation.

The problematic SP have a <ds:signature> section in their metadata;
while syntactically correct, their metadata is rejected by the DS with
following messages in the log :

-8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<-
10:36:15.630 - WARN [org.apache.xml.security.signature.XMLSignature:-1]
- Signature verification failed.
10:36:15.630 - DEBUG [org.opensaml.xml.signature.SignatureValidator:77]
- Signature did not validate against the credential's key
10:36:15.631 - DEBUG
[org.opensaml.xml.signature.impl.BaseSignatureTrustEngine:144] -
Signature validation using candidate validation credential failed
org.opensaml.xml.validation.ValidationException: Signature did not
validate against the credential's key
        at
org.opensaml.xml.signature.SignatureValidator.validate(SignatureValidator.java:79)
...
10:36:15.631 - DEBUG
[org.opensaml.xml.signature.impl.ExplicitKeySignatureTrustEngine:115] -
Failed to verify signature using either KeyInfo-derived or directly
trusted credentials
10:36:15.631 - ERROR
[org.opensaml.saml2.metadata.provider.SignatureValidationFilter:311] -
Signature trust establishment failed for metadata entry
https://secure.nature.com/shibboleth
10:36:15.632 - ERROR
[org.opensaml.saml2.metadata.provider.SignatureValidationFilter:254] -
EntityDescriptor 'https://secure.nature.com/shibboleth' failed signature
verification, removing from metadata provider
10:36:15.634 - DEBUG
[org.opensaml.saml2.metadata.provider.AbstractReloadingMetadataProvider:264]
- Error occurred while attempting to refresh metadata from '{}'
..
-8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<-


I know that the certificate present in their metadata is a self-signed.
Is that the cause of the problem ?

Is there a tool in the Shibboleth stuff to help me verify the signature
of the metadata "by hand" (I mean using command line...) ?

This problem is critical as if the error is triggered, the DS stops to
process the remaining of the metadata file and, doesn't start up anymore.

Any help would be appreciated... ;)

Pascal
-- 
*Pascal Panneels*
Project Manager
Belnet . Services
Louizalaan 231 Avenue Louise
Brussel 1050 Bruxelles
België . Belgique
T: +32 2 790 33 33
*www.belnet.be <http://www.belnet.be>*
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130620/86678e5f/attachment-0001.html 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 3268 bytes
Desc: S/MIME Cryptographic Signature
Url : http://shibboleth.net/pipermail/users/attachments/20130620/86678e5f/attachment-0001.bin