Detected a problem with assertion: Unable to establish security of incoming assertion.

[kripp]

We are the SP and are receiving a message from an IDP that is using IDP
initiated POST binding.  I am seeing the following error in our logs "WARN
Shibboleth.SSO.SAML2 [1]: detected a problem with assertion: Unable to
establish security of incoming assertion."  This is the first time I have
seen this problem and everything else seems to be getting processed
correctly.  I've seen other posts indicate that it could have something to
do with the clock on the IDP, but I'm not sure that is the case here.  Below
are the logs and decrypted Assertion with all personal information blocked
out.  Please let me know if you can tell what the issue is. 

2014-11-26 10:48:23 DEBUG Shibboleth.SSO.SAML2 [1]: decrypted Assertion: 
<?xml version="1.0" encoding="UTF-8"?> 
<saml:Assertion xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
ID="*HIDDEN*" IssueInstant="2014-11-26T16:47:23.758Z" Version="2.0">
   <saml:Issuer>*HIDDEN*</saml:Issuer>
   <saml:Subject>
      <saml:NameID
Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified">*HIDDEN*</saml:NameID>
      <saml:SubjectConfirmation
Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
         <saml:SubjectConfirmationData
NotOnOrAfter="2014-11-26T16:50:23.76Z"
Recipient="*HIDDEN*/Shibboleth.sso/SAML2/POST" />
      </saml:SubjectConfirmation>
   </saml:Subject>
   <saml:Conditions NotBefore="2014-11-26T16:44:23.758Z"
NotOnOrAfter="2014-11-26T16:50:23.758Z">
      <saml:AudienceRestriction>
         <saml:Audience>*HIDDEN*</saml:Audience>
      </saml:AudienceRestriction>
   </saml:Conditions>
   <saml:AuthnStatement AuthnInstant="2014-11-26T16:47:23.76Z"
SessionIndex="*HIDDEN*">
      <saml:AuthnContext>
        
<saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:unspecified</saml:AuthnContextClassRef>
      </saml:AuthnContext>
   </saml:AuthnStatement>
   <saml:AttributeStatement>
      <saml:Attribute Name="FirstName">
         <saml:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:type="xs:string">*HIDDEN*</saml:AttributeValue>
      </saml:Attribute>
      <saml:Attribute Name="LastName">
         <saml:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:type="xs:string">*HIDDEN*</saml:AttributeValue>
      </saml:Attribute>
      <saml:Attribute Name="Email">
         <saml:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:type="xs:string">*HIDDEN*</saml:AttributeValue>
      </saml:Attribute>
      <saml:Attribute Name="EmployeeId">
         <saml:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:type="xs:string">*HIDDEN GUID*</saml:AttributeValue>
      </saml:Attribute>
   </saml:AttributeStatement>
</saml:Assertion>

2014-11-26 10:48:23 DEBUG Shibboleth.SSO.SAML2 [1]: extracting issuer from
SAML 2.0 assertion 
2014-11-26 10:48:23 DEBUG OpenSAML.SecurityPolicyRule.MessageFlow [1]:
evaluating message flow policy (replay checking on, expiration 60) 
2014-11-26 10:48:23 DEBUG XMLTooling.StorageService [1]: inserted record
(_ad1fefc0-53d9-4fea-98ae-77fb5bb83191) in context (MessageFlow) with
expiration (1417020683) 
2014-11-26 10:48:23 DEBUG OpenSAML.SecurityPolicyRule.BearerConfirmation
[1]: assertion satisfied bearer confirmation requirements 
2014-11-26 10:48:23 WARN Shibboleth.SSO.SAML2 [1]: detected a problem with
assertion: Unable to establish security of incoming assertion. 
2014-11-26 10:54:52 INFO XMLTooling.StorageService : purged 2 expired
record(s) from storage 

Thanks



--
View this message in context: http://shibboleth.1660669.n2.nabble.com/Detected-a-problem-with-assertion-Unable-to-establish-security-of-incoming-assertion-tp7609484.html
Sent from the Shibboleth - Users mailing list archive at Nabble.com.