ServiceNow Integration Issue

Thu May 9 00:18:55 EDT 2013

Hi Scott:

Attached below is the error generated in the IdP logs.

Would you happen to have any tips on why the rror was triggered? I am
reverse engineering the integration between production and development (as
I do not have access to the ServiceNow config) - the production works but
not the development instance (although the confis on the IdP side are the
same).

21:08:04.261 - DEBUG
[edu.internet2.middleware.shibboleth.idp.profile.saml2.AbstractSAML2ProfileHandler:552]
- Determining if SAML assertion to relying party '
https://xxx.service-now.com' should be signed
21:08:04.261 - DEBUG
[edu.internet2.middleware.shibboleth.idp.profile.saml2.AbstractSAML2ProfileHandler:625]
- IdP relying party configuration 'default' indicates to sign assertions:
false
21:08:04.262 - DEBUG
[edu.internet2.middleware.shibboleth.idp.profile.saml2.AbstractSAML2ProfileHandler:632]
- Entity metadata for relying party 'https://xxx.service-now.com 'indicates
to sign assertions: false
21:08:04.262 - DEBUG
[edu.internet2.middleware.shibboleth.idp.profile.saml2.AbstractSAML2ProfileHandler:269]
- Attempting to encrypt assertion to relying party '
https://xxx.service-now.com'
21:08:04.266 - DEBUG [org.opensaml.security.MetadataCredentialResolver:157]
- Forcing on-demand metadata provider refresh if necessary
21:08:04.271 - DEBUG [org.opensaml.security.MetadataCredentialResolver:205]
- Attempting to retrieve credentials from cache using index: [
https://ubcdev.service-now.com
,{urn:oasis:names:tc:SAML:2.0:metadata}SPSSODescriptor,urn:oasis:names:tc:SAML:2.0:protocol,ENCRYPTION]
21:08:04.271 - DEBUG [org.opensaml.security.MetadataCredentialResolver:222]
- Unable to retrieve credentials from cache using index: [
https://ubcdev.service-now.com
,{urn:oasis:names:tc:SAML:2.0:metadata}SPSSODescriptor,urn:oasis:names:tc:SAML:2.0:protocol,ENCRYPTION]
21:08:04.271 - DEBUG [org.opensaml.security.MetadataCredentialResolver:242]
- Attempting to retrieve credentials from metadata for entity:
https://ubcdev.service-now.com
21:08:04.271 - DEBUG [org.opensaml.security.MetadataCredentialResolver:314]
- Retrieving metadata for entity 'https://ubcdev.service-now.com' in role
'{urn:oasis:names:tc:SAML:2.0:metadata}SPSSODescriptor' for protocol
'urn:oasis:names:tc:SAML:2.0:protocol'
21:08:04.272 - DEBUG
[org.opensaml.saml2.metadata.provider.ChainingMetadataProvider:254] -
Checking child metadata provider for entity descriptor with entity ID:
https://ubcdev.service-now.com
21:08:04.272 - DEBUG
[org.opensaml.saml2.metadata.provider.AbstractMetadataProvider:509] -
Searching for entity descriptor with an entity ID of
https://ubcdev.service-now.com
21:08:04.272 - DEBUG
[org.opensaml.saml2.metadata.provider.AbstractMetadataProvider:250] -
Metadata document did not contain a descriptor for entity
https://ubcdev.service-now.com
21:08:04.272 - DEBUG
[org.opensaml.saml2.metadata.provider.AbstractMetadataProvider:317] -
Metadata document did not contain any role descriptors of type
{urn:oasis:names:tc:SAML:2.0:metadata}SPSSODescriptor for entity
https://ubcdev.service-now.com
21:08:04.272 - DEBUG
[org.opensaml.saml2.metadata.provider.AbstractMetadataProvider:286] -
Metadata document does not contain a role of type
{urn:oasis:names:tc:SAML:2.0:metadata}SPSSODescriptor supporting protocol
urn:oasis:names:tc:SAML:2.0:protocol for entity
https://ubcdev.service-now.com
21:08:04.273 - DEBUG
[org.opensaml.saml2.metadata.provider.ChainingMetadataProvider:254] -
Checking child metadata provider for entity descriptor with entity ID:
https://ubcdev.service-now.com
21:08:04.273 - DEBUG
[org.opensaml.saml2.metadata.provider.AbstractMetadataProvider:509] -
Searching for entity descriptor with an entity ID of
https://ubcdev.service-now.com
21:08:04.273 - DEBUG [org.opensaml.security.MetadataCredentialResolver:347]
- Added new credential collection to cache with key: [
https://ubcdev.service-now.com
,{urn:oasis:names:tc:SAML:2.0:metadata}SPSSODescriptor,urn:oasis:names:tc:SAML:2.0:protocol,ENCRYPTION]
21:08:04.276 - DEBUG
[org.opensaml.xml.security.credential.criteria.EvaluableCredentialCriteriaRegistry:185]
- Loading default evaluable credential criteria mappings
21:08:04.277 - DEBUG
[org.opensaml.xml.security.credential.criteria.EvaluableCredentialCriteriaRegistry:131]
- Registering class
org.opensaml.xml.security.credential.criteria.EvaluableKeyAlgorithmCredentialCriteria
as evaluator for class
org.opensaml.xml.security.criteria.KeyAlgorithmCriteria
21:08:04.278 - DEBUG
[org.opensaml.xml.security.credential.criteria.EvaluableCredentialCriteriaRegistry:131]
- Registering class
org.opensaml.xml.security.credential.criteria.EvaluableKeyLengthCredentialCriteria
as evaluator for class org.opensaml.xml.security.criteria.KeyLengthCriteria
21:08:04.279 - DEBUG
[org.opensaml.xml.security.credential.criteria.EvaluableCredentialCriteriaRegistry:131]
- Registering class
org.opensaml.xml.security.credential.criteria.EvaluableX509SubjectKeyIdentifierCredentialCriteria
as evaluator for class
org.opensaml.xml.security.x509.X509SubjectKeyIdentifierCriteria
21:08:04.280 - DEBUG
[org.opensaml.xml.security.credential.criteria.EvaluableCredentialCriteriaRegistry:131]
- Registering class
org.opensaml.xml.security.credential.criteria.EvaluablePublicKeyCredentialCriteria
as evaluator for class org.opensaml.xml.security.criteria.PublicKeyCriteria
21:08:04.281 - DEBUG
[org.opensaml.xml.security.credential.criteria.EvaluableCredentialCriteriaRegistry:131]
- Registering class
org.opensaml.xml.security.credential.criteria.EvaluableX509IssuerSerialCredentialCriteria
as evaluator for class
org.opensaml.xml.security.x509.X509IssuerSerialCriteria
21:08:04.282 - DEBUG
[org.opensaml.xml.security.credential.criteria.EvaluableCredentialCriteriaRegistry:131]
- Registering class
org.opensaml.xml.security.credential.criteria.EvaluableUsageCredentialCriteria
as evaluator for class org.opensaml.xml.security.criteria.UsageCriteria
21:08:04.283 - DEBUG
[org.opensaml.xml.security.credential.criteria.EvaluableCredentialCriteriaRegistry:131]
- Registering class
org.opensaml.xml.security.credential.criteria.EvaluableEntityIDCredentialCriteria
as evaluator for class org.opensaml.xml.security.criteria.EntityIDCriteria
21:08:04.284 - DEBUG
[org.opensaml.xml.security.credential.criteria.EvaluableCredentialCriteriaRegistry:131]
- Registering class
org.opensaml.xml.security.credential.criteria.EvaluableKeyNameCredentialCriteria
as evaluator for class org.opensaml.xml.security.criteria.KeyNameCriteria
21:08:04.285 - DEBUG
[org.opensaml.xml.security.credential.criteria.EvaluableCredentialCriteriaRegistry:131]
- Registering class
org.opensaml.xml.security.credential.criteria.EvaluableX509SubjectNameCredentialCriteria
as evaluator for class
org.opensaml.xml.security.x509.X509SubjectNameCriteria
21:08:04.285 - DEBUG
[org.opensaml.xml.security.credential.criteria.EvaluableCredentialCriteriaRegistry:106]
- Registry could not locate evaluable criteria for criteria class
org.opensaml.security.MetadataCriteria
21:08:04.285 - DEBUG
[org.opensaml.xml.security.credential.criteria.EvaluableCredentialCriteriaRegistry:75]
- Registry located evaluable criteria class
org.opensaml.xml.security.credential.criteria.EvaluableEntityIDCredentialCriteria
for criteria class org.opensaml.xml.security.criteria.EntityIDCriteria
21:08:04.286 - DEBUG
[org.opensaml.xml.security.credential.criteria.EvaluableCredentialCriteriaRegistry:75]
- Registry located evaluable criteria class
org.opensaml.xml.security.credential.criteria.EvaluableUsageCredentialCriteria
for criteria class org.opensaml.xml.security.criteria.UsageCriteria
21:08:04.287 - ERROR
[edu.internet2.middleware.shibboleth.idp.profile.saml2.AbstractSAML2ProfileHandler:888]
- Could not resolve a key encryption credential for peer entity:
https://ubcdev.service-now.com
21:08:05.639 - ERROR
[edu.internet2.middleware.shibboleth.idp.profile.saml2.AbstractSAML2ProfileHandler:275]
- Unable to construct encrypter
org.opensaml.xml.security.SecurityException: Could not resolve key
encryption credential
    at
edu.internet2.middleware.shibboleth.idp.profile.saml2.AbstractSAML2ProfileHandler.getEncrypter(AbstractSAML2ProfileHandler.java:889)
~[shibboleth-identityprovider.jar:na]
    at
edu.internet2.middleware.shibboleth.idp.profile.saml2.AbstractSAML2ProfileHandler.buildResponse(AbstractSAML2ProfileHandler.java:272)
~[shibboleth-identityprovider.jar:na]
    at
edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.completeAuthenticationRequest(SSOProfileHandler.java:280)
[shibboleth-identityprovider.jar:na]

On Wed, May 8, 2013 at 8:49 PM, It Meme <it.meme01 at gmail.com> wrote:

> Hi Scott:
>
> Thank you for your post.
>
>
> >You have to sign the response or the assertion.
>
> Where is signing of response or assertion set?
>
> ServiceNow does things a little differently from other SPs we have
> integrated with - I am a bit at sea trying to figure out why this does not
> work in our development instance but works in production (but the
> configurations are identical).
>
> Any guidance will be greatly appreciated.
>
> Thanks.
>
>
>
>
>
> On Wed, May 8, 2013 at 5:21 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:
>
>> On 5/8/13 5:36 PM, "It Meme" <it.meme01 at gmail.com> wrote:
>> >
>> >Would you have any ideas on what to look for? Is this something
>> >ServiceNow should update on their end?
>>
>> Well, it's your setting. You have to sign the response or the assertion.
>> AFAIK, S-N handles either correctly. I don't know if the IdP can be
>> convinced to sign neither one, but obviously if you did, it's not going to
>> work.
>>
>> -- Scott
>>
>>
>> --
>> To unsubscribe from this list send an email to
>> users-unsubscribe at shibboleth.net
>>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130508/3b5aaa7e/attachment-0001.html 