Initial Setup -- Cannot Get SP and IDP Talking

[Sam Agnew]

As far as I can tell I do have the correct metadata. The keys embedded in the metadata also seem to match. You say I can check the incoming SAML response but I'm not sure how to do that. I'm using HTTPS so tcpdump won't tell me much. I can see a response requesting a cookie when I follow all the redirects using the Firebug extension in Firefox. I don't see a key in the response but I'm not sure what I'm looking for.

How can I see what key is in the SAML response? I have checked for time, the servers are in the same time zone and on NTP. The clocks agree.

What can I check to narrow things down?

Thanks!

Sam




On Nov 20, 2013, at 4:45 PM, Paul Hethmon wrote:

Verify you've given Shib SP the correct metadata. That's either the public key is wrong or there's a time skew between the IdP and SP servers. The incoming SAML Response will have the public key embedded in it so you can compare it to what SP is loading.

Paul

From: Sam Agnew <saa2012 at qatar-med.cornell.edu<mailto:saa2012 at qatar-med.cornell.edu>>
Reply-To: Shibboleth Users <users at shibboleth.net<mailto:users at shibboleth.net>>
Date: Wednesday, November 20, 2013 3:55 AM
To: Shibboleth Users <users at shibboleth.net<mailto:users at shibboleth.net>>
Subject: Re: Initial Setup -- Cannot Get SP and IDP Talking

What I am now getting after successful login on the loginpage (UserPassword auth via LDAP) is the following from the SP:

opensaml::FatalProfileException at (https://unixadmin.qatar-med.cornell.edu/Shibboleth.sso/SAML2/POST)

Unable to establish security of incoming assertion.

The shibd.log says:
2013-11-20 11:45:18 WARN Shibboleth.SSO.SAML2 [3]: detected a problem with assertion: Unable to establish security of incoming assertion.

--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net<mailto:users-unsubscribe at shibboleth.net>


--
Sam Agnew
System Administrator
IT Department
Weill Cornell Medical College in Qatar



-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20131124/c28eb08d/attachment.html