Salesforce error when authing against Shibboleth

[Ben Branch]

Scott,

>From my SAML Tracer Output:

<ds:X509Certificate>MIIDJDCCAgygAwIBAgIVAKXbPQtoZ1ddCWZxKtTzjvSipgfTMA0GCSqGSIb3DQEBBQUAMBkxFzAV
BgNVBAMTDmNhc2Rldi51Y28uZWR1MB4XDTE0MDgwNTEzNDM0OVoXDTM0MDgwNTEzNDM0OVowGTEX
MBUGA1UEAxMOY2FzZGV2LnVjby5lZHUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCy
8syRlmvLBJK3wrpggp1MRH81gXq0lh0AIocvIb90JKm0mTp5I+BTSO16vRjVxBygnJQvezR8Ll1Z
Iuu0FSZeUUMuLR+r2C0Av2B5dsGFph1A7e4XAJ4FsfTFmg5xqJ4UwASgQqpOgtN+olgzYU/DXxMi
eJQdiaG2iFGlIEBJqS5vQSK0Yr6X9qESwzPnSdVfow8WOiVHWs9FH1dk4M3QVRLpyhJkn+z1I7Vo
ykMEJmN0MyXYjDYqPdcbz8BIEYrs7WHwxLCX2ak42CMFCECHi1eP0dz40FaOBo2uyxW7Jb5dscEu
pEVuc0III/FgtfKOzRvzYRtdwfD1aizWIsqFAgMBAAGjYzBhMEAGA1UdEQQ5MDeCDmNhc2Rldi51
Y28uZWR1hiVodHRwczovL2Nhc2Rldi51Y28uZWR1L2lkcC9zaGliYm9sZXRoMB0GA1UdDgQWBBRQ
G2/BSgKIJzcWV9FPLP6zZup9TzANBgkqhkiG9w0BAQUFAAOCAQEAbQnSZjEuGPa2OqvII/WipVxx
cbWVl27+n+GFDJh0dCDarbas18ItavgHvbRM9UcCF+73clPcX62vCfrw/pT+Rs22c0vVdltBN2D2
Sqes4VQz10Q64aDGsxGQPawS4jS8fhQtTSfA0tp1gjwH4fJ075+sdRfh7loXfQ7e4ADt0/8QR/7S
SNfNUMvBD1HjYn4qpsYfOl/6HFIfvAwkQ8Ni2oLi9oi4G6IE0CbRGGXhOS+tJBeRDtpqaRifGloV
nu9yZehFJSg1DrZ7ZYhAxE5GvP9sNarhuLesxMJpA5YwVkOUxt51HvDrtSqT40dA68b9RkeMdTtp
RlTLKPHfORl3/g==</ds:X509Certificate>

>From my idp-metadata.xml:

 (both X509 Elements are the same)

<KeyDescriptor>
            <ds:KeyInfo>
                <ds:X509Data>
                    <ds:X509Certificate>
MIIDJDCCAgygAwIBAgIVAKXbPQtoZ1ddCWZxKtTzjvSipgfTMA0GCSqGSIb3DQEB
BQUAMBkxFzAVBgNVBAMTDmNhc2Rldi51Y28uZWR1MB4XDTE0MDgwNTEzNDM0OVoX
DTM0MDgwNTEzNDM0OVowGTEXMBUGA1UEAxMOY2FzZGV2LnVjby5lZHUwggEiMA0G
CSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCy8syRlmvLBJK3wrpggp1MRH81gXq0
lh0AIocvIb90JKm0mTp5I+BTSO16vRjVxBygnJQvezR8Ll1ZIuu0FSZeUUMuLR+r
2C0Av2B5dsGFph1A7e4XAJ4FsfTFmg5xqJ4UwASgQqpOgtN+olgzYU/DXxMieJQd
iaG2iFGlIEBJqS5vQSK0Yr6X9qESwzPnSdVfow8WOiVHWs9FH1dk4M3QVRLpyhJk
n+z1I7VoykMEJmN0MyXYjDYqPdcbz8BIEYrs7WHwxLCX2ak42CMFCECHi1eP0dz4
0FaOBo2uyxW7Jb5dscEupEVuc0III/FgtfKOzRvzYRtdwfD1aizWIsqFAgMBAAGj
YzBhMEAGA1UdEQQ5MDeCDmNhc2Rldi51Y28uZWR1hiVodHRwczovL2Nhc2Rldi51
Y28uZWR1L2lkcC9zaGliYm9sZXRoMB0GA1UdDgQWBBRQG2/BSgKIJzcWV9FPLP6z
Zup9TzANBgkqhkiG9w0BAQUFAAOCAQEAbQnSZjEuGPa2OqvII/WipVxxcbWVl27+
n+GFDJh0dCDarbas18ItavgHvbRM9UcCF+73clPcX62vCfrw/pT+Rs22c0vVdltB
N2D2Sqes4VQz10Q64aDGsxGQPawS4jS8fhQtTSfA0tp1gjwH4fJ075+sdRfh7loX
fQ7e4ADt0/8QR/7SSNfNUMvBD1HjYn4qpsYfOl/6HFIfvAwkQ8Ni2oLi9oi4G6IE
0CbRGGXhOS+tJBeRDtpqaRifGloVnu9yZehFJSg1DrZ7ZYhAxE5GvP9sNarhuLes
xMJpA5YwVkOUxt51HvDrtSqT40dA68b9RkeMdTtpRlTLKPHfORl3/g==
                    </ds:X509Certificate>

Output of the idp.crt on the server:

[root at huginn shibboleth-idp]# cd credentials/
[root at huginn credentials]# ls
idp.crt  idp.jks  idp.key
[root at huginn credentials]# cat idp.crt
-----BEGIN CERTIFICATE-----
MIIDJDCCAgygAwIBAgIVAKXbPQtoZ1ddCWZxKtTzjvSipgfTMA0GCSqGSIb3DQEB
BQUAMBkxFzAVBgNVBAMTDmNhc2Rldi51Y28uZWR1MB4XDTE0MDgwNTEzNDM0OVoX
DTM0MDgwNTEzNDM0OVowGTEXMBUGA1UEAxMOY2FzZGV2LnVjby5lZHUwggEiMA0G
CSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCy8syRlmvLBJK3wrpggp1MRH81gXq0
lh0AIocvIb90JKm0mTp5I+BTSO16vRjVxBygnJQvezR8Ll1ZIuu0FSZeUUMuLR+r
2C0Av2B5dsGFph1A7e4XAJ4FsfTFmg5xqJ4UwASgQqpOgtN+olgzYU/DXxMieJQd
iaG2iFGlIEBJqS5vQSK0Yr6X9qESwzPnSdVfow8WOiVHWs9FH1dk4M3QVRLpyhJk
n+z1I7VoykMEJmN0MyXYjDYqPdcbz8BIEYrs7WHwxLCX2ak42CMFCECHi1eP0dz4
0FaOBo2uyxW7Jb5dscEupEVuc0III/FgtfKOzRvzYRtdwfD1aizWIsqFAgMBAAGj
YzBhMEAGA1UdEQQ5MDeCDmNhc2Rldi51Y28uZWR1hiVodHRwczovL2Nhc2Rldi51
Y28uZWR1L2lkcC9zaGliYm9sZXRoMB0GA1UdDgQWBBRQG2/BSgKIJzcWV9FPLP6z
Zup9TzANBgkqhkiG9w0BAQUFAAOCAQEAbQnSZjEuGPa2OqvII/WipVxxcbWVl27+
n+GFDJh0dCDarbas18ItavgHvbRM9UcCF+73clPcX62vCfrw/pT+Rs22c0vVdltB
N2D2Sqes4VQz10Q64aDGsxGQPawS4jS8fhQtTSfA0tp1gjwH4fJ075+sdRfh7loX
fQ7e4ADt0/8QR/7SSNfNUMvBD1HjYn4qpsYfOl/6HFIfvAwkQ8Ni2oLi9oi4G6IE
0CbRGGXhOS+tJBeRDtpqaRifGloVnu9yZehFJSg1DrZ7ZYhAxE5GvP9sNarhuLes
xMJpA5YwVkOUxt51HvDrtSqT40dA68b9RkeMdTtpRlTLKPHfORl3/g==
-----END CERTIFICATE-----



Ben Branch
UNIX/Linux Administrator
University of Central Oklahoma
ITIL Foundation v3, Network+, RHCSA

100 N. University Drive, Box 122
Edmond, OK 73034
D: 405.974.2649 | M: 405.550.6804 | bbranch at uco.edu | www.uco.edu

"I am wiser than this man, for neither of us appears to know anything great and good; but he fancies he knows something, although he knows nothing; whereas I, as I do not know anything, so I do not fancy I do. In this trifling particular, then, I appear to be wiser than he, because I do not fancy I know what I do not know."  - Socrates

-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Wednesday, August 06, 2014 2:42 PM
To: Shib Users
Subject: Re: Salesforce error when authing against Shibboleth

On 8/6/14, 3:20 PM, "Ben Branch" <BBranch at uco.edu> wrote:

>
>
>Everything else in the SAML Validator checks out fine.  I am at a
>complete loss as to where I need to start looking on how to resolve
>this issue.  Any help would be greatly appreciated.

If you really are 100% certain that the key is correct, then they have to debug it, not you.

I set up a sandbox at salesforce.com last week and while I don't have any kind of actual login working yet, I had no problem getting the validator to show green in that section.

Occam's Razor would suggest that you don't have the right key uploaded yet, or at least they're not using it.

-- Scott

--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
**Bronze+Blue=Green** The University of Central Oklahoma is Bronze, Blue, and Green! Please print this e-mail only if absolutely necessary!

**CONFIDENTIALITY** -This e-mail (including any attachments) may contain confidential, proprietary and privileged information. Any unauthorized disclosure or use of this information is prohibited.