Having trouble with connecting to InCommon Federation SPs

[Brian Gibson]

Hi all,

Newbie here.... be gentle :-)

I have Shibboleth IdP v2.4 running and I can successfully log into 
TestShib. We recently joined the InCommon Federation and I did the steps 
they required (submitted our participation agreement, protected Tomcat 
by getting a GeoTrust-issued SSL certificate, I uploaded our new 
certificate and our metadata to InCommon, etc..). but I am running into 
issues trying to make a connection to their test SP located here

https://service1.internet2.edu/test/

I get redirected to our local login page and after I successfully 
authenticate against Active Directory I get the following error

********************************************************
opensaml::FatalProfileException

The system encountered an error at Thu Oct 3 14:54:24 2013

To report this problem, please contact the site administrator at 
root at localhost.

Please include the following message in any email:

opensaml::FatalProfileException at 
(https://service1.internet2.edu/Shibboleth.sso/SAML2/POST)

*Message was signed, but signature could not be verified.*
********************************************************

I was told by an InCommon Tech that our configured signing key does not 
match the certificate in the metadata that we submitted. Taking a guess 
here, I think the problem has to do with the following entry in our 
relying-party.xml file

---------------------------------------------------------------------------------
  <!-- ========================================== -->
  <!--     Security Configurations                -->
  <!-- ========================================== -->
     <security:Credential id="IdPCredential" 
xsi:type="security:X509Filesystem">
         <security:PrivateKey>C:\Program Files 
(x86)\Internet2\Shib2Idp/credentials/idp.key</security:PrivateKey>
         <security:Certificate>C:\Program Files 
(x86)\Internet2\Shib2Idp/credentials/idp.crt</security:Certificate>
     </security:Credential>
----------------------------------------------------------------------------------

The idp.key and idp.crt files look to be self signed certs that were put 
in place when Shibboleth was installed. I "think" I need to point the 
<security:PrivateKey> and <security:Certificate> values at the keystore 
database file we generated using the keytool.exe command along with the 
new SSL cert that we bought from GeoTrust (which was based off the CSR 
generated off of the keystore database).

But...when I switch the above values to this

-------------------------------------------------------------------------------------
<!-- ========================================== -->
     <!--     Security Configurations                -->
     <!-- ========================================== -->
     <security:Credential id="IdPCredential" 
xsi:type="security:X509Filesystem">
<security:PrivateKey>C:\ssl\shib.wheatonma.edu.kdb</security:PrivateKey>
<security:Certificate>C:\ssl\shib_wheatonma_edu.p7s</security:Certificate>
     </security:Credential>
--------------------------------------------------------------------------------------

and stop/start Tomcat the IdP will not come up and in the 
idp-process.log file I get the following

--------------------------------------------------------------------------------------
16:06:01.188 - ERROR 
[edu.internet2.middleware.shibboleth.common.config.BaseService:188] - 
Configuration was not loaded for 
shibboleth.RelyingPartyConfigurationManager service, error creating 
components.  The root cause of this error was: 
org.apache.commons.ssl.ProbablyNotPKCS8Exception: asn1 parse failure: 
java.io.IOException: DER length more than 4 bytes
---------------------------------------------------------------------------------------

Any thoughts on where I am going wrong? Should I be separating the 
certificates and use the GeoTrust one just for browser traffic 
protection and use the self signed ones that came with Shibboleth as the 
ones I submit to InCommon?

Thanks


-- 

++++++++++++++++++++++++++++
Brian Gibson
Systems Administrator
Wheaton College

Are you a musician? If so visit my Arbans Online music site at
http://arbansonline.com and listen & contribute

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20131004/ba0405db/attachment.html