Message was signed, but signature could not be verified.

[Farzan Qureshi]

Hi Paul,

I have installed SAML Trace. I get following trace from the plugin:


<samlp:AuthnRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"

AssertionConsumerServiceURL="https://idp.rosmini.school.nz/Shibboleth.sso/SAML2/POST"

Destination="https://idp.rosmini.school.nz/idp/profile/SAML2/Redirect/SSO"
                    ID="_8b677a03966229fa6253887da45d58c2"
                    IssueInstant="2014-08-13T23:13:31Z"

ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
                    Version="2.0"
                    >
    <saml:Issuer
xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">https://idp.rosmini.school.nz/idp/shibboleth</saml:Issuer>
    <samlp:NameIDPolicy AllowCreate="1" />
</samlp:AuthnRequest>



I then matched it with the metadata Provided to IdP.

Following value exists which matches the SP AuthnRequest:

<md:SPSSODescriptor
protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol

My "entityID" is

https://idp.rosmini.school.nz/idp/shibboleth



There is no mismatch
Any further ideas?


On 14 August 2014 10:54, Paul Hethmon <paul.hethmon at clareitysecurity.com>
wrote:

>  On Aug 13, 2014, at 6:48 PM, Farzan Qureshi <fqureshi at rosmini.school.nz>
> wrote:
>
>  *Error Message: No peer endpoint available to which to send SAML
> response*
>
>
>  This means the ACS URL in your AuthnRequest does not match any ACS URL
> in the metadata given to the IdP. ACS URL's are an EXACT match, case
> included, etc. Your SP is sending something that is wrong, or you gave the
> IdP the wrong metadata. Either way, it doesn't match.
>
>  Get a copy of FireFox and install the SAML Tracer plugin. Open SAML
> Tracer and run your test. You will see the exact value in the AuthnRequest
> the SP is sending. Match it against the metadata provided to the IdP. Then
> trace back to figure out why they are different.
>
>  Paul
>
> Paul Hethmon
> Chief Software Architect
> paul.hethmon at clareitysecurity.com
>
>
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>



-- 
*Farzan Qureshi* | Network Administrator & Help-desk Support | Rosmini
College | (09) 487 0 530

-- 
This email and any files transmitted with it are confidential and intended 
solely for the use of the individual or entity to whom they are addressed. 
If you have received this email in error please notify the system manager (
admin at rosmini.school.nz). Please note that any views or opinions presented 
in this email are solely those of the author and do not necessarily 
represent those of the company. Finally, the recipient should check this 
email and any attachments for the presence of viruses. Rosmini College 
accepts no liability for any damage caused by any virus transmitted by this 
email.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20140814/e6ee8daa/attachment.html