Initial Setup -- Cannot Get SP and IDP Talking

[Cantor, Scott]

On 11/30/13, 6:47 AM, "Sam Agnew" <saa2012 at qatar-med.cornell.edu> wrote:
>
>Is there a way I can check? I'm pretty sure I verified that the cert in
>the metadata matches the cert file.

Mainly by examining the KeyInfo in the signature in the assertion. The
worst case sanity check is to extract the XML with extreme care and work
on independently verifying the signature using the "known" key from the
IdP that is in the metadata you gave the SP. The samlsign utility that
OpenSAML comes with can do that.

>I'm pretty sure that isn't the case but is there a way to "reset" the
>situation? Can I run the installer again? If so, what will I need to
>reconfigure on IDP and SP afterwards?

The installer won't overwrite anything or generate a new key pair unless
you start from scratch. The point is the metadata on disk is irrelevant.
You have to compare the keypair the IdP is actually using to the metadata
you have the SP.

>>You'll have to compare the credentials on the IdP to the message in the
>> log and to what's in the metadata you gave the SP.
>> 
>
>In this context, what do we mean by credentials?

The signing keypair. The public key certificate principally, which is in
idp.crt.

To be honest, I would probably look into registering your SP with
testshib.org and running some tests with that. To rule out some kind of
really low level problem with your system.

-- Scott