"Error Message: Message did not meet security requirements"

Tue Nov 26 08:44:55 EST 2013

Hi,

I try to set up Shibboleth IDP for our SP.
I've followed instructions in IdPInstall document and successfully installed
Apache tomcat and IDP.
The following https://HOSTNAME/idp/profile/Status test returned "ok".

Next, I've tried to setup SAML metadata for IDP, SP, and made changes in
"relying-party.xml".
Here is the content of my idp-metadata.xml:

<?xml version="1.0" encoding="UTF-8"?>
<EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata"
xmlns:ds="http://www.w3.org/2000/09/xmldsig#"
xmlns:shibmd="urn:mace:shibboleth:metadata:1.0"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
entityID="https://midp.10.39.2.138.xip.io/idp/shibboleth">

    <IDPSSODescriptor protocolSupportEnumeration="urn:mace:shibboleth:1.0
urn:oasis:names:tc:SAML:1.1:protocol urn:oasis:names:tc:SAML:2.0:protocol">

        <Extensions>
            <shibmd:Scope regexp="false">xip.io</shibmd:Scope>
        </Extensions>

        <KeyDescriptor>
            <ds:KeyInfo>
                <ds:X509Data>
                    <ds:X509Certificate>
.... my certificate
                    </ds:X509Certificate>
                </ds:X509Data>
            </ds:KeyInfo>
        </KeyDescriptor>

        <ArtifactResolutionService
Binding="urn:oasis:names:tc:SAML:1.0:bindings:SOAP-binding"
Location="http://midp.10.39.2.138.xip.io:8080/idp/profile/SAML1/SOAP/ArtifactResolution"
index="1"/>

        <ArtifactResolutionService
Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP"
Location="http://midp.10.39.2.138.xip.io:8080/idp/profile/SAML2/SOAP/ArtifactResolution"
index="2"/>

        <SingleLogoutService
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"
Location="http://midp.10.39.2.138.xip.io:8080/idp/profile/SAML2/Redirect/SLO"
/>

        <SingleLogoutService
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
Location="http://midp.10.39.2.138.xip.io:8080/idp/profile/SAML2/POST/SLO" />

        <SingleLogoutService
Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP"
Location="http://midp.10.39.2.138.xip.io:8080/idp/profile/SAML2/SOAP/SLO" />

        <NameIDFormat>urn:mace:shibboleth:1.0:nameIdentifier</NameIDFormat>

<NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</NameIDFormat>

        <SingleSignOnService
Binding="urn:mace:shibboleth:1.0:profiles:AuthnRequest"
Location="http://midp.10.39.2.138.xip.io:8080/idp/profile/Shibboleth/SSO"/>

        <SingleSignOnService
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
Location="http://midp.10.39.2.138.xip.io:8080/idp/profile/SAML2/POST/SSO"/>

        <SingleSignOnService
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign"
Location="http://midp.10.39.2.138.xip.io:8080/idp/profile/SAML2/POST-SimpleSign/SSO"/>

        <SingleSignOnService
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"
Location="http://midp.10.39.2.138.xip.io:8080/idp/profile/SAML2/Redirect/SSO"/>
    </IDPSSODescriptor>

    <AttributeAuthorityDescriptor
protocolSupportEnumeration="urn:oasis:names:tc:SAML:1.1:protocol
urn:oasis:names:tc:SAML:2.0:protocol">

        <Extensions>
            <shibmd:Scope regexp="false">xip.io</shibmd:Scope>
        </Extensions>

        <KeyDescriptor>
            <ds:KeyInfo>
                <ds:X509Data>
                    <ds:X509Certificate>
.... my certificate
                    </ds:X509Certificate>
                </ds:X509Data>
            </ds:KeyInfo>
        </KeyDescriptor>

        <AttributeService
Binding="urn:oasis:names:tc:SAML:1.0:bindings:SOAP-binding"
Location="http://midp.10.39.2.138.xip.io:8080/idp/profile/SAML1/SOAP/AttributeQuery"/>

        <AttributeService
Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP"
Location="http://midp.10.39.2.138.xip.io:8080/idp/profile/SAML2/SOAP/AttributeQuery"/>

        <NameIDFormat>urn:mace:shibboleth:1.0:nameIdentifier</NameIDFormat>

<NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</NameIDFormat>

    </AttributeAuthorityDescriptor>

</EntityDescriptor>

A content of SP metadata:

<md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
entityID="URLMD">
	<md:SPSSODescriptor WantAssertionsSigned="false"
AuthnRequestsSigned="false"
protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
		<md:KeyDescriptor use="signing">
			<KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#">
				<X509Data>
					<X509Certificate>
...
</X509Certificate>
				</X509Data>
			</KeyInfo>
		</md:KeyDescriptor>
		<md:KeyDescriptor use="encryption">
			<KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#">
				<X509Data>
					<X509Certificate>
...
</X509Certificate>
				</X509Data>
			</KeyInfo>
		</md:KeyDescriptor>

<md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</md:NameIDFormat>
		<md:AssertionConsumerService
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"

Location="http://midp.10.39.2.130.xip.io:8080/attask/saml2consumer.cmd"
									 index="0"
									 isDefault="true"/>
		<md:AssertionConsumerService
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-REDIRECT"

Location="http://midp.10.39.2.130.xip.io:8080/attask/saml2consumer.cmd"
									 index="1"/>
	</md:SPSSODescriptor>
</md:EntityDescriptor>

And my relying-party.xml:

<?xml version="1.0" encoding="UTF-8"?>

<rp:RelyingPartyGroup xmlns:rp="urn:mace:shibboleth:2.0:relying-party"
xmlns:saml="urn:mace:shibboleth:2.0:relying-party:saml" 
                      xmlns:metadata="urn:mace:shibboleth:2.0:metadata"
xmlns:resource="urn:mace:shibboleth:2.0:resource" 
                      xmlns:security="urn:mace:shibboleth:2.0:security"
xmlns:samlsec="urn:mace:shibboleth:2.0:security:saml" 
                      xmlns:samlmd="urn:oasis:names:tc:SAML:2.0:metadata"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 

xsi:schemaLocation="urn:mace:shibboleth:2.0:relying-party
classpath:/schema/shibboleth-2.0-relying-party.xsd

urn:mace:shibboleth:2.0:relying-party:saml
classpath:/schema/shibboleth-2.0-relying-party-saml.xsd
                                          urn:mace:shibboleth:2.0:metadata
classpath:/schema/shibboleth-2.0-metadata.xsd
                                          urn:mace:shibboleth:2.0:resource
classpath:/schema/shibboleth-2.0-resource.xsd 
                                          urn:mace:shibboleth:2.0:security
classpath:/schema/shibboleth-2.0-security.xsd

urn:mace:shibboleth:2.0:security:saml
classpath:/schema/shibboleth-2.0-security-policy-saml.xsd

urn:oasis:names:tc:SAML:2.0:metadata
classpath:/schema/saml-schema-metadata-2.0.xsd">

    <rp:AnonymousRelyingParty
provider="https://midp.10.39.2.138.xip.io/idp/shibboleth"
defaultSigningCredentialRef="IdPCredential"/>

    <rp:DefaultRelyingParty
provider="https://midp.10.39.2.138.xip.io/idp/shibboleth"
defaultSigningCredentialRef="IdPCredential">

        <rp:ProfileConfiguration xsi:type="saml:ShibbolethSSOProfile"
includeAttributeStatement="false" 
                                 assertionLifetime="PT5M"
signResponses="conditional" signAssertions="never"
                                 includeConditionsNotBefore="true"/>

        <rp:ProfileConfiguration xsi:type="saml:SAML1AttributeQueryProfile"
assertionLifetime="PT5M" 
                                 signResponses="conditional"
signAssertions="never"
                                 includeConditionsNotBefore="true"/>

        <rp:ProfileConfiguration
xsi:type="saml:SAML1ArtifactResolutionProfile" signResponses="conditional" 
                                 signAssertions="never"/>

        <rp:ProfileConfiguration xsi:type="saml:SAML2SSOProfile"
includeAttributeStatement="true" 
                                 assertionLifetime="PT5M"
assertionProxyCount="0" 
                                 signResponses="never"
signAssertions="always" 
                                 encryptAssertions="conditional"
encryptNameIds="never"
                                 includeConditionsNotBefore="true"/>

        <rp:ProfileConfiguration xsi:type="saml:SAML2ECPProfile"
includeAttributeStatement="true" 
                                 assertionLifetime="PT5M"
assertionProxyCount="0" 
                                 signResponses="never"
signAssertions="always" 
                                 encryptAssertions="conditional"
encryptNameIds="never"
                                 includeConditionsNotBefore="true"/>

        <rp:ProfileConfiguration xsi:type="saml:SAML2AttributeQueryProfile" 
                                 assertionLifetime="PT5M"
assertionProxyCount="0" 
                                 signResponses="conditional"
signAssertions="never" 
                                 encryptAssertions="conditional"
encryptNameIds="never"
                                 includeConditionsNotBefore="true"/>

        <rp:ProfileConfiguration
xsi:type="saml:SAML2ArtifactResolutionProfile" 
                                 signResponses="never"
signAssertions="always" 
                                 encryptAssertions="conditional"
encryptNameIds="never"/>

        <rp:ProfileConfiguration xsi:type="saml:SAML2LogoutRequestProfile"
                                 signResponses="conditional"/>

    </rp:DefaultRelyingParty>

    <metadata:MetadataProvider id="ShibbolethMetadata"
xsi:type="metadata:ChainingMetadataProvider">

        <metadata:MetadataProvider id="URLMD"
xsi:type="metadata:FilesystemMetadataProvider"

metadataFile="/Users/mariam/Desktop/tttt/shibboleth-idp/metadata/some-metadata.xml">

            <metadata:MetadataFilter xsi:type="metadata:ChainingFilter">

	            <metadata:MetadataFilter
xsi:type="metadata:EntityRoleWhiteList">

<metadata:RetainedRole>samlmd:SPSSODescriptor</metadata:RetainedRole>

                </metadata:MetadataFilter>

            </metadata:MetadataFilter>

        </metadata:MetadataProvider>

    </metadata:MetadataProvider>

    <security:Credential id="IdPCredential"
xsi:type="security:X509Filesystem">

<security:PrivateKey>/Users/mariam/Desktop/tttt/shibboleth-idp/credentials/idp.key</security:PrivateKey>

<security:Certificate>/Users/mariam/Desktop/tttt/shibboleth-idp/credentials/idp.crt</security:Certificate>
    </security:Credential>

    <security:TrustEngine id="shibboleth.MetadataTrustEngine"
xsi:type="security:StaticExplicitKeySignature">
        <security:Credential id="MyFederation1Credentials"
xsi:type="security:X509Filesystem">

<security:Certificate>/Users/mariam/Desktop/tttt/shibboleth-idp/credentials/idp.crt</security:Certificate>
        </security:Credential>
    </security:TrustEngine>

    <security:TrustEngine id="shibboleth.SignatureTrustEngine"
xsi:type="security:SignatureChaining">
        <security:TrustEngine
id="shibboleth.SignatureMetadataExplicitKeyTrustEngine"
xsi:type="security:MetadataExplicitKeySignature"
metadataProviderRef="ShibbolethMetadata"/>                              
        <security:TrustEngine
id="shibboleth.SignatureMetadataPKIXTrustEngine"
xsi:type="security:MetadataPKIXSignature"
metadataProviderRef="ShibbolethMetadata"/>
    </security:TrustEngine>

    <security:TrustEngine id="shibboleth.CredentialTrustEngine"
xsi:type="security:Chaining">
        <security:TrustEngine
id="shibboleth.CredentialMetadataExplictKeyTrustEngine"
xsi:type="security:MetadataExplicitKey"
metadataProviderRef="ShibbolethMetadata"/>
        <security:TrustEngine
id="shibboleth.CredentialMetadataPKIXTrustEngine"
xsi:type="security:MetadataPKIXX509Credential"
metadataProviderRef="ShibbolethMetadata"/>
    </security:TrustEngine>

    <security:SecurityPolicy id="shibboleth.ShibbolethSSOSecurityPolicy"
xsi:type="security:SecurityPolicyType">
        <security:Rule xsi:type="samlsec:Replay" required="false"/>
        <security:Rule xsi:type="samlsec:IssueInstant" required="false"/>
        <security:Rule xsi:type="samlsec:MandatoryIssuer"/>
    </security:SecurityPolicy>

    <security:SecurityPolicy
id="shibboleth.SAML1AttributeQuerySecurityPolicy"
xsi:type="security:SecurityPolicyType">
        <security:Rule xsi:type="samlsec:Replay"/>
        <security:Rule xsi:type="samlsec:IssueInstant"/>
        <security:Rule xsi:type="samlsec:ProtocolWithXMLSignature"
trustEngineRef="shibboleth.SignatureTrustEngine"/>
        <security:Rule xsi:type="security:ClientCertAuth"
trustEngineRef="shibboleth.CredentialTrustEngine"/>
        <security:Rule xsi:type="samlsec:MandatoryIssuer"/>
        <security:Rule xsi:type="security:MandatoryMessageAuthentication"/>
    </security:SecurityPolicy>

    <security:SecurityPolicy
id="shibboleth.SAML1ArtifactResolutionSecurityPolicy"
xsi:type="security:SecurityPolicyType">
        <security:Rule xsi:type="samlsec:Replay"/>
        <security:Rule xsi:type="samlsec:IssueInstant"/>
        <security:Rule xsi:type="samlsec:ProtocolWithXMLSignature"
trustEngineRef="shibboleth.SignatureTrustEngine"/>
        <security:Rule xsi:type="security:ClientCertAuth"
trustEngineRef="shibboleth.CredentialTrustEngine"/>
        <security:Rule xsi:type="samlsec:MandatoryIssuer"/>
        <security:Rule xsi:type="security:MandatoryMessageAuthentication"/>
    </security:SecurityPolicy>

    <security:SecurityPolicy id="shibboleth.SAML2SSOSecurityPolicy"
xsi:type="security:SecurityPolicyType">
        <security:Rule xsi:type="samlsec:Replay"/>
        <security:Rule xsi:type="samlsec:IssueInstant"/>
        <security:Rule xsi:type="samlsec:SAML2AuthnRequestsSigned"/>
        <security:Rule xsi:type="samlsec:ProtocolWithXMLSignature"
trustEngineRef="shibboleth.SignatureTrustEngine"/>
        <security:Rule xsi:type="samlsec:SAML2HTTPRedirectSimpleSign"
trustEngineRef="shibboleth.SignatureTrustEngine"/>
        <security:Rule xsi:type="samlsec:SAML2HTTPPostSimpleSign"
trustEngineRef="shibboleth.SignatureTrustEngine"/>
        <security:Rule xsi:type="samlsec:MandatoryIssuer"/>
    </security:SecurityPolicy>

    <security:SecurityPolicy
id="shibboleth.SAML2AttributeQuerySecurityPolicy"
xsi:type="security:SecurityPolicyType">
        <security:Rule xsi:type="samlsec:Replay"/>
        <security:Rule xsi:type="samlsec:IssueInstant"/>
        <security:Rule xsi:type="samlsec:ProtocolWithXMLSignature"
trustEngineRef="shibboleth.SignatureTrustEngine"/>
        <security:Rule xsi:type="samlsec:SAML2HTTPRedirectSimpleSign"
trustEngineRef="shibboleth.SignatureTrustEngine"/>
        <security:Rule xsi:type="samlsec:SAML2HTTPPostSimpleSign"
trustEngineRef="shibboleth.SignatureTrustEngine"/>
        <security:Rule xsi:type="security:ClientCertAuth"
trustEngineRef="shibboleth.CredentialTrustEngine"/>
        <security:Rule xsi:type="samlsec:MandatoryIssuer"/>
        <security:Rule xsi:type="security:MandatoryMessageAuthentication"/>
    </security:SecurityPolicy>

    <security:SecurityPolicy
id="shibboleth.SAML2ArtifactResolutionSecurityPolicy"
xsi:type="security:SecurityPolicyType">
        <security:Rule xsi:type="samlsec:Replay"/>
        <security:Rule xsi:type="samlsec:IssueInstant"/>
        <security:Rule xsi:type="samlsec:ProtocolWithXMLSignature"
trustEngineRef="shibboleth.SignatureTrustEngine"/>
        <security:Rule xsi:type="samlsec:SAML2HTTPRedirectSimpleSign"
trustEngineRef="shibboleth.SignatureTrustEngine"/>
        <security:Rule xsi:type="samlsec:SAML2HTTPPostSimpleSign"
trustEngineRef="shibboleth.SignatureTrustEngine"/>
        <security:Rule xsi:type="security:ClientCertAuth"
trustEngineRef="shibboleth.CredentialTrustEngine"/>
        <security:Rule xsi:type="samlsec:MandatoryIssuer"/>
        <security:Rule xsi:type="security:MandatoryMessageAuthentication"/>
    </security:SecurityPolicy>

    <security:SecurityPolicy id="shibboleth.SAML2SLOSecurityPolicy"
xsi:type="security:SecurityPolicyType">
        <security:Rule xsi:type="samlsec:Replay"/>
        <security:Rule xsi:type="samlsec:IssueInstant"/>
        <security:Rule xsi:type="samlsec:ProtocolWithXMLSignature"
trustEngineRef="shibboleth.SignatureTrustEngine"/>
        <security:Rule xsi:type="samlsec:SAML2HTTPRedirectSimpleSign"
trustEngineRef="shibboleth.SignatureTrustEngine"/>
        <security:Rule xsi:type="samlsec:SAML2HTTPPostSimpleSign"
trustEngineRef="shibboleth.SignatureTrustEngine"/>
        <security:Rule xsi:type="security:ClientCertAuth"
trustEngineRef="shibboleth.CredentialTrustEngine"/>
        <security:Rule xsi:type="samlsec:MandatoryIssuer"/>
        <security:Rule xsi:type="security:MandatoryMessageAuthentication"/>
    </security:SecurityPolicy>

</rp:RelyingPartyGroup>

With this setup I'm getting "Error Message: Message did not meet security
requirements" error.
There is no any error in my "idp-process.log" file.

If I uncomment

                <metadata:MetadataFilter
xsi:type="metadata:SignatureValidation"

trustEngineRef="shibboleth.MetadataTrustEngine"
                                requireSignedMetadata="true" />
filter I'm getting "Metadata root element was unsigned and signatures are
required." error.

Can you help me to figure out what is wrong ? If there is no error in
"idp-process.log" file why I'm getting "Error Message: Message did not meet
security requirements" message

Thanks,
Mariam

--
View this message in context: http://shibboleth.1660669.n2.nabble.com/Error-Message-Message-did-not-meet-security-requirements-tp7591791.html
Sent from the Shibboleth - Users mailing list archive at Nabble.com.