Validation of protocol message signature failed

[kotesh201]

Hi,

I am sending the signed AuthnRequest from SP to IDP. Shibboleth on IDP is
throwing below error on verifying the signature.

I added my CA cert info in idp-metadata.xml file as one of the Extensions. I
am not sure whether Shibboleth refers to this config file for signature
verification. Is there any other config file should I modify to fix below
error. If you need any specific information, I can provide.

14:28:43.829 - DEBUG [org.apache.xml.security.signature.Reference:-1] -
Verification successful for URI "#_f01e1e67af92a67708d93e865375600"
14:28:43.829 - DEBUG [org.apache.xml.security.signature.Manifest:-1] - The
Reference has Type 
14:28:43.860 - WARN
[edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler:348]
- Message did not meet security requirements
org.opensaml.ws.security.SecurityPolicyException: Validation of protocol
message signature failed
	at
org.opensaml.common.binding.security.SAMLProtocolMessageXMLSignatureSecurityPolicyRule.doEvaluate(SAMLProtocolMessageXMLSignatureSecurityPolicyRule.java:138)
~[opensaml.jar:na]
	at
org.opensaml.common.binding.security.SAMLProtocolMessageXMLSignatureSecurityPolicyRule.evaluate(SAMLProtocolMessageXMLSignatureSecurityPolicyRule.java:107)
~[opensaml.jar:na]
	at
org.opensaml.ws.security.provider.BasicSecurityPolicy.evaluate(BasicSecurityPolicy.java:51)
~[openws.jar:na]
	at
org.opensaml.ws.message.decoder.BaseMessageDecoder.processSecurityPolicy(BaseMessageDecoder.java:132)
~[openws.jar:na]
	at
org.opensaml.ws.message.decoder.BaseMessageDecoder.decode(BaseMessageDecoder.java:83)
~[openws.jar:na]
	at
org.opensaml.saml2.binding.decoding.BaseSAML2MessageDecoder.decode(BaseSAML2MessageDecoder.java:70)
~[opensaml.jar:na]
	at
edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.decodeRequest(SSOProfileHandler.java:332)
[shibboleth-identityprovider.jar:na]
	at
edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.performAuthentication(SSOProfileHandler.java:190)
[shibboleth-identityprovider.jar:na]
	at
edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.processRequest(SSOProfileHandler.java:161)
[shibboleth-identityprovider.jar:na]
	at
edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.processRequest(SSOProfileHandler.java:88)
[shibboleth-identityprovider.jar:na]
	at
edu.internet2.middleware.shibboleth.common.profile.ProfileRequestDispatcherServlet.service(ProfileRequestDispatcherServlet.java:84)
[shibboleth-common.jar:na]
	at javax.servlet.http.HttpServlet.service(HttpServlet.java:717)
[servlet-api.jar:na]
	at
org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290)
[catalina.jar:6.0.32]
	at
org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
[catalina.jar:6.0.32]
	at com.test.server.SAMLRespFilter.doFilter(SAMLRespFilter.java:88)
[obidp-web.jar:na]
	at
org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
[catalina.jar:6.0.32]
	at
org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
[catalina.jar:6.0.32]
	at
edu.internet2.middleware.shibboleth.idp.util.NoCacheFilter.doFilter(NoCacheFilter.java:50)
[shibboleth-identityprovider.jar:na]
	at
org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
[catalina.jar:6.0.32]
	at
org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
[catalina.jar:6.0.32]
	at
edu.internet2.middleware.shibboleth.idp.session.IdPSessionFilter.doFilter(IdPSessionFilter.java:81)
[shibboleth-identityprovider.jar:na]
	at
org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
[catalina.jar:6.0.32]
	at
org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
[catalina.jar:6.0.32]
	at
edu.internet2.middleware.shibboleth.common.log.SLF4JMDCCleanupFilter.doFilter(SLF4JMDCCleanupFilter.java:52)
[shibboleth-common.jar:na]
	at
org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
[catalina.jar:6.0.32]
	at
org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
[catalina.jar:6.0.32]
	at
org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:233)
[catalina.jar:6.0.32]
	at
org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:191)
[catalina.jar:6.0.32]
	at
org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:127)
[catalina.jar:6.0.32]
	at
org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102)
[catalina.jar:6.0.32]
	at
org.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:554)
[catalina.jar:6.0.32]
	at
org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109)
[catalina.jar:6.0.32]
	at
org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:298)
[catalina.jar:6.0.32]
	at
org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:859)
[tomcat-coyote.jar:6.0.32]
	at
org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process(Http11Protocol.java:588)
[tomcat-coyote.jar:6.0.32]
	at org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:489)
[tomcat-coyote.jar:6.0.32]
	at java.lang.Thread.run(Thread.java:619) [na:1.6.0_11]


Any pointers to fix this issue would be appreciated.

Thanks,
Kotesh



--
View this message in context: http://shibboleth.1660669.n2.nabble.com/Validation-of-protocol-message-signature-failed-tp7587981.html
Sent from the Shibboleth - Users mailing list archive at Nabble.com.