Unable to establish security of incoming assertion

[Nate Klingenstein]

Session initiation should be fine and I see nothing wrong with your SP configuration.  The problem is likely something in the incoming message.  If you turn up shibd.logger to DEBUG, you should be able to see that incoming message.

On Jun 27, 2013, at 20:11 , Justin Russo wrote:

> Hi Scott,
> thanks for the quick reply.
> here is some more info.
> Initially when i set up shibboleth for the first time i test using University of south California idp.
> Now when im trying to connect to my IDP provider "ABC Company" i used the existing shibboleth2.xml file and modified it accordingly. 
> Currently when i check i have the below questionable stuff in my shibboleth2.xml
> 
> <SessionInitiator type="Chaining" Location="/Login" isDefault="true" id="Intranet"
>                     relayState="cookie" entityID="https://abccompany.org/SAML2/IDP"
>                     acsByIndex="false">
>                 <SessionInitiator type="SAML2" acsIndex="1" template="bindingTemplate.html"/>
>                 <SessionInitiator type="Shib1" acsIndex="5"/>
>             </SessionInitiator>
> 
>             
>             <!-- An example using an old-style WAYF, which means Shib 1 only unless an entityID is provided. -->
>             <SessionInitiator type="Chaining" Location="/WAYF/shibboleth.usc.edu" id="usc" relayState="cookie">
>                 <SessionInitiator type="SAML2" acsIndex="1" template="bindingTemplate.html"/>
>                 <SessionInitiator type="Shib1" acsIndex="5"/>
>                 <SessionInitiator type="WAYF" acsIndex="5" URL="https://shibboleth-test.usc.edu/idp/profile/Shibboleth/SSO"/>
>             </SessionInitiator>
> 
> I know im nbot using University of south California idp any more, can i remove the WAYF Session initiator attribute ?
> 
> do you think this is the cause
> 
> thanks
> Justin
> 
> From: "Cantor, Scott" <cantor.2 at osu.edu>
> To: Shib Users <users at shibboleth.net> 
> Sent: Thursday, June 27, 2013 4:04 PM
> Subject: Re: Unable to establish security of incoming assertion
> 
> On 6/27/13 3:49 PM, "justin9" <justin9 at ymail.com> wrote:
> 
> >Hi Nate,
> >The file attached here.
> >shibd.log 
> ><http://shibboleth.1660669.n2.nabble.com/file/n7587944/shibd.log>
> 
> I would turn up logging to DEBUG to see if anything more comes out, but
> the sparseness of information leads me to believe the error is something
> extremely unusual, like a non-Shibboleth IdP that isn't signing anything
> in the response. It's not normal to get that error without more in the log
> than that one warning.
> 
> -- Scott
> 
> 
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
> 
> 
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net