Spring SAML SP Can't Recognize IdP Certificate (Signature Validation Failed)

[Nick Duan]

Thanks Scott for your help.  I know that IdP couldn't dictate how SP choose
keys.   I was hoping someone from this mailing list may have some experience
integrating Shibboleth IdP with Spring Security.

Another option to make it to work is let IdP not to sign the assertion in
the SSO response.   I configured the Spring Security SP to set the metadata
parameter "wantAssertionSigned" to false.    Apparently Shibboleth IdP
ignored that part and kept signing the authentication assertion.   Any ideas
on how to make the IdP recognize the SP's request not wanting assertion to
be signed?

Thanks!

ND

-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On
Behalf Of Cantor, Scott
Sent: Friday, February 14, 2014 1:42 PM
To: Shib Users
Subject: Re: Spring SAML SP Can't Recognize IdP Certificate (Signature
Validation Failed)

On 2/14/14, 12:51 PM, "nduan at dtechspace.com" <nduan at dtechspace.com> wrote:

>If I am not mistaking, the authentication assertion in Authn response 
>message shall be signed by the IdP using its private key, and the SP 
>would use IdP's public key, which is available in the IdP's metadata 
>accessible by the SP, to verify the signature.

That's correct.

>Am I missing some
>configuration parameters in either SP or IdP to enable SP to pick the 
>right public key?

The IdP has nothing much to do with how an SP chooses to find keys. It does
include a KeyInfo hint and there can be obscure cases where that causes
problems, but it certainly has nothing to do with this.

-- Scott


--
To unsubscribe from this list send an email to
users-unsubscribe at shibboleth.net