Unable to establish security of incoming assertion

[Justin Russo]

Hi Scott,
thanks for the quick reply.
here is some more info.
Initially when i set up shibboleth for the first time i test using University of south California idp.
Now when im trying to connect to my IDP provider "ABC Company" i used the existing shibboleth2.xml file and modified it accordingly. 
Currently when i check i have the below questionable stuff in my shibboleth2.xml

<SessionInitiator type="Chaining" Location="/Login" isDefault="true" id="Intranet"
                    relayState="cookie" entityID="https://abccompany.org/SAML2/IDP"
                    acsByIndex="false">
                <SessionInitiator type="SAML2" acsIndex="1" template="bindingTemplate.html"/>
                <SessionInitiator type="Shib1" acsIndex="5"/>
            </SessionInitiator>

            
            <!-- An example using an old-style WAYF, which means Shib 1 only unless an entityID is provided. -->
            <SessionInitiator type="Chaining" Location="/WAYF/shibboleth.usc.edu" id="usc" relayState="cookie">
                <SessionInitiator type="SAML2" acsIndex="1" template="bindingTemplate.html"/>
                <SessionInitiator type="Shib1" acsIndex="5"/>
                <SessionInitiator type="WAYF" acsIndex="5" URL="https://shibboleth-test.usc.edu/idp/profile/Shibboleth/SSO"/>
            </SessionInitiator>

I know im nbot using University of south California idp any more, can i remove the WAYF Session initiator attribute ?

do you think this is the cause

thanks
Justin


________________________________
 From: "Cantor, Scott" <cantor.2 at osu.edu>
To: Shib Users <users at shibboleth.net> 
Sent: Thursday, June 27, 2013 4:04 PM
Subject: Re: Unable to establish security of incoming assertion
 

On 6/27/13 3:49 PM, "justin9" <justin9 at ymail.com> wrote:

>Hi Nate,
>The file attached here.
>shibd.log 
><http://shibboleth.1660669.n2.nabble.com/file/n7587944/shibd.log>

I would turn up logging to DEBUG to see if anything more comes out, but
the sparseness of information leads me to believe the error is something
extremely unusual, like a non-Shibboleth IdP that isn't signing anything
in the response. It's not normal to get that error without more in the log
than that one warning.

-- Scott


--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130627/c020d3fe/attachment-0001.html