Unable to establish security of incoming assertion
Dewberry, James
JDewberry at nfp.com
Wed Feb 19 10:16:32 EST 2014
Hello,
I have an SP that’s up and running with 4 IdPs, and everything’s good. We have a new IdP that wants to join, but when they send their assertion, we get a message saying:
Unable to establish security of incoming assertion
And it’s because:
2014-02-19 09:28:45 DEBUG XMLTooling.TrustEngine.ExplicitKey [9]: public key did not validate signature: Digital signature does not validate with the supplied key.
Here’s the relevant portion of the shibd.log file:
2014-02-19 09:28:45 DEBUG OpenSAML.SecurityPolicyRule.XMLSigning [9]: validating signature profile
2014-02-19 09:28:45 DEBUG XMLTooling.TrustEngine.ExplicitKey [9]: attempting to validate signature with the peer's credentials
2014-02-19 09:28:45 DEBUG XMLTooling.TrustEngine.ExplicitKey [9]: public key did not validate signature: Digital signature does not validate with the supplied key.
2014-02-19 09:28:45 DEBUG XMLTooling.TrustEngine.ExplicitKey [9]: no peer credentials validated the signature
2014-02-19 09:28:45 DEBUG XMLTooling.TrustEngine.PKIX [9]: validating signature using certificate from within the signature
2014-02-19 09:28:45 DEBUG XMLTooling.TrustEngine.PKIX [9]: Digital signature does not validate with the supplied key.
2014-02-19 09:28:45 DEBUG XMLTooling.TrustEngine.PKIX [9]: failed to verify signature with embedded certificates
2014-02-19 09:28:45 ERROR OpenSAML.SecurityPolicyRule.XMLSigning [9]: unable to verify message signature with supplied trust engine
2014-02-19 09:28:45 DEBUG Shibboleth.SSO.SAML2 [9]: processing message against SAML 2.0 SSO profile
2014-02-19 09:28:45 DEBUG Shibboleth.SSO.SAML2 [9]: extracting issuer from SAML 2.0 assertion
2014-02-19 09:28:45 DEBUG OpenSAML.SecurityPolicyRule.MessageFlow [9]: evaluating message flow policy (replay checking on, expiration 60)
2014-02-19 09:28:45 DEBUG XMLTooling.StorageService [9]: inserted record (c75f7ca4-a232-419b-bbd3-5a60dd11a6c5) in context (MessageFlow) with expiration (1392820357)
2014-02-19 09:28:45 DEBUG OpenSAML.SecurityPolicyRule.BearerConfirmation [9]: assertion satisfied bearer confirmation requirements
2014-02-19 09:28:45 WARN Shibboleth.SSO.SAML2 [9]: detected a problem with assertion: Unable to establish security of incoming assertion.
The client swears up and down that the signature is valid, but I’m not too familiar with how the signature stuff works.
Do you have any suggestions on:
1. How can I validate the signature myself?
2. Is there any configuration I can do to get the signature verified?
3. Any thoughts on what I can do next?
4. Are they using a signature method that Shibboleth doesn’t like?
Thanks for your help,
Jim
In case it matters, the client wants to post an unsolicited assertion from a simple webpage like this:
<<script>window.onload = function() { document.forms[0].submit(); }</script>
<html>
<form action="https://myserver.com/Shibboleth.sso/SAML2/POST" method="post">
<input type="hidden" name="applicationId" value=“myapp" />
<input type="hidden" name="entityID" value=“myentity" />
<input type="hidden" name="RelayState" value=“myCustomUrl" />
<input type="hidden" name="SAMLResponse" value=“[A base64 encoded message]" />
</form>
</html>
Here’s the full log in case it’s useful:
2014-02-19 09:28:45 DEBUG Shibboleth.Listener [9]: dispatching message (default/SAML2/POST)
2014-02-19 09:28:45 DEBUG OpenSAML.MessageDecoder.SAML2POST [9]: validating input
2014-02-19 09:28:45 DEBUG OpenSAML.MessageDecoder.SAML2POST [9]: decoded SAML message:
<saml2p:Response Destination="https://myserver.com/Shibboleth.sso/SAML2/POST"
ID="324bbbee-53dd-493b-9803-8ff29929a985"
IssueInstant="2014-02-19T14:28:37Z"
Version="2.0"
xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol"
xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"
>
<saml2:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity"
xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"
>myentityID</saml2:Issuer>
<saml2p:Status>
<saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" />
</saml2p:Status>
<saml2:Assertion ID="c75f7ca4-a232-419b-bbd3-5a60dd11a6c5"
IssueInstant="2014-02-19T14:28:37"
Version="2.0"
xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"
>
<saml2:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity”> myentityID</saml2:Issuer>
<saml2:Subject>
<saml2:NameID
Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">
joe at smith.com<mailto:joe at smith.com>
</saml2:NameID>
<saml2:SubjectConfirmation
Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
<saml2:SubjectConfirmationData
Recipient="https://myserver.com/Shibboleth.sso/SAML2/POST"
NotOnOrAfter="2014-02-19T14:48:37Z"
/>
</saml2:SubjectConfirmation>
</saml2:Subject>
<saml2:AuthnStatement AuthnInstant="2014-02-19T14:28:37Z">
<saml2:AuthnContext>
<saml2:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml2:AuthnContextClassRef>
</saml2:AuthnContext>
</saml2:AuthnStatement>
<saml2:AttributeStatement>
<saml2:Attribute Name="COMPANYID"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"
>
<saml2:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
>144</saml2:AttributeValue>
</saml2:Attribute>
<saml2:Attribute Name="persistent-id"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"
>
<saml2:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
>joe at smith.com<mailto:joe at smith.com></saml2:AttributeValue>
</saml2:Attribute>
</saml2:AttributeStatement>
</saml2:Assertion>
<Signature xmlns="http://www.w3.org/2000/09/xmldsig#">
<SignedInfo>
<CanonicalizationMethod Algorithm="http://www.w3.org/TR/2001/REC-xml-c14n-20010315" />
<SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" />
<Reference URI="">
<Transforms>
<Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" />
</Transforms>
<DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" />
<DigestValue>BRIbSP7q4VxG5/sPllz4Xi+NIoM=</DigestValue>
</Reference>
</SignedInfo>
<SignatureValue>QJcEG/kZxINORad9pprp4+LCaw8EUYM5PtqdwyzUY1o1WCuUDkKXqGSMcCYLJPAx+k6xTGd8cyRwYch2/mPrlmfkrt42BYRyYI+YixIeQqbG4JfcArda7N1jCk/Ak/rBSK3e6MC+Ll74H62P4oCCvsuMXhx6ceFXTMn6AIRw1lU=</SignatureValue>
<KeyInfo>
<X509Data>
<X509Certificate>MIIB/TCCAWqgAwIBAgIQJfGyh4Sm76xCGw7IjeYfyTAJBgUrDgMCHQUAMBkxFzAVBgNVBAMTDmludC5zYy5tdWZnLmpwMB4XDTEyMDEwMjAwMDAwMFoXDTIyMDEwMjAwMDAwMFowGTEXMBUGA1UEAxMOaW50LnNjLm11ZmcuanAwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAMfxjpGrzF+7+RQljEIMNf7k5Z+6gmqXsRlZkreKCgUHcnUcy64k3h0a4jR1ZMJCOdqg6guiByj+O1QS+ZHORfimGfsDkCDBgUXQgEFtrwyQZ0d/9/EDAQ7lTt3lgvoeK/brWvLt4hkjLCxw/mwh1XgRtzM0RE3Cduied/ZeFuhLAgMBAAGjTjBMMEoGA1UdAQRDMEGAEDoHSUgUNl6mzGHaVednaL+hGzAZMRcwFQYDVQQDEw5pbnQuc2MubXVmZy5qcIIQJfGyh4Sm76xCGw7IjeYfyTAJBgUrDgMCHQUAA4GBAATJQ1tC1EDHkB3DevkgOMXKBuEq3b2iA90j9jUtr2Vwuw08mv4VT8yQzly6UueUjm5t4i8V1z1uGX6euTFuS4VTUKogrGoDR2/cKIaQACjmYJYFkUFX4ZNgQm7x4qI71u8BwGP5JJVP98wU5dhaSkEa9zr7YuxKIafoMCPAiSTz</X509Certificate>
</X509Data>
</KeyInfo>
</Signature>
</saml2p:Response>
2014-02-19 09:28:45 DEBUG XMLTooling.XMLObject.Builder [9]: located XMLObjectBuilder for element name: saml2p:Response
2014-02-19 09:28:45 DEBUG XMLTooling.XMLObject [9]: unmarshalling DOM element (saml2p:Response)
2014-02-19 09:28:45 DEBUG XMLTooling.XMLObject [9]: unmarshalling attributes for DOM element (saml2p:Response)
[… Generic unmarshalling messages …]
2014-02-19 09:28:45 DEBUG XMLTooling.XMLObject.Builder [9]: located XMLObjectBuilder for element name: {http://www.w3.org/2000/09/xmldsig#}Signature
2014-02-19 09:28:45 DEBUG XMLTooling.XMLObject [9]: unmarshalling child element ({http://www.w3.org/2000/09/xmldsig#}Signature)
2014-02-19 09:28:45 DEBUG XMLTooling.XMLObject.Signature [9]: unmarshalling ds:Signature
2014-02-19 09:28:45 DEBUG XMLTooling.XMLObject [9]: processing text content at position (4)
2014-02-19 09:28:45 DEBUG OpenSAML.MessageDecoder.SAML2 [9]: extracting issuer from SAML 2.0 protocol message
2014-02-19 09:28:45 DEBUG XMLTooling.XMLObject.Builder [9]: located XMLObjectBuilder for element name: saml2:Issuer
2014-02-19 09:28:45 DEBUG XMLTooling.XMLObject [9]: unmarshalling DOM element (saml2:Issuer)
2014-02-19 09:28:45 DEBUG XMLTooling.XMLObject [9]: unmarshalling attributes for DOM element (saml2:Issuer)
2014-02-19 09:28:45 DEBUG XMLTooling.XMLObject [9]: processing generic attribute
2014-02-19 09:28:45 DEBUG XMLTooling.XMLObject [9]: found namespace declaration, adding it to the list of namespaces on the XMLObject
2014-02-19 09:28:45 DEBUG XMLTooling.XMLObject [9]: unmarshalling child nodes of DOM element (saml2:Issuer)
2014-02-19 09:28:45 DEBUG XMLTooling.XMLObject [9]: processing text content at position (0)
2014-02-19 09:28:45 DEBUG OpenSAML.MessageDecoder.SAML2 [9]: message from (myEntity)
2014-02-19 09:28:45 DEBUG OpenSAML.MessageDecoder.SAML2 [9]: searching metadata for message issuer...
2014-02-19 09:28:45 DEBUG OpenSAML.SecurityPolicyRule.MessageFlow [9]: evaluating message flow policy (replay checking on, expiration 60)
2014-02-19 09:28:45 DEBUG XMLTooling.StorageService [9]: inserted record (324bbbee-53dd-493b-9803-8ff29929a985) in context (MessageFlow) with expiration (1392820357)
2014-02-19 09:28:45 DEBUG OpenSAML.SecurityPolicyRule.XMLSigning [9]: validating signature profile
2014-02-19 09:28:45 DEBUG XMLTooling.TrustEngine.ExplicitKey [9]: attempting to validate signature with the peer's credentials
2014-02-19 09:28:45 DEBUG XMLTooling.TrustEngine.ExplicitKey [9]: public key did not validate signature: Digital signature does not validate with the supplied key.
2014-02-19 09:28:45 DEBUG XMLTooling.TrustEngine.ExplicitKey [9]: no peer credentials validated the signature
2014-02-19 09:28:45 DEBUG XMLTooling.TrustEngine.PKIX [9]: validating signature using certificate from within the signature
2014-02-19 09:28:45 DEBUG XMLTooling.TrustEngine.PKIX [9]: Digital signature does not validate with the supplied key.
2014-02-19 09:28:45 DEBUG XMLTooling.TrustEngine.PKIX [9]: failed to verify signature with embedded certificates
2014-02-19 09:28:45 ERROR OpenSAML.SecurityPolicyRule.XMLSigning [9]: unable to verify message signature with supplied trust engine
2014-02-19 09:28:45 DEBUG Shibboleth.SSO.SAML2 [9]: processing message against SAML 2.0 SSO profile
2014-02-19 09:28:45 DEBUG Shibboleth.SSO.SAML2 [9]: extracting issuer from SAML 2.0 assertion
2014-02-19 09:28:45 DEBUG OpenSAML.SecurityPolicyRule.MessageFlow [9]: evaluating message flow policy (replay checking on, expiration 60)
2014-02-19 09:28:45 DEBUG XMLTooling.StorageService [9]: inserted record (c75f7ca4-a232-419b-bbd3-5a60dd11a6c5) in context (MessageFlow) with expiration (1392820357)
2014-02-19 09:28:45 DEBUG OpenSAML.SecurityPolicyRule.BearerConfirmation [9]: assertion satisfied bearer confirmation requirements
2014-02-19 09:28:45 WARN Shibboleth.SSO.SAML2 [9]: detected a problem with assertion: Unable to establish security of incoming assertion.
**********************************************************************
This e-mail may contain information that is privileged, confidential or protected under state or federal law. If you are not an intended recipient of this email, please delete it, notify the sender immediately, and do not copy, use or disseminate any information in the e-mail. Pursuant to IRS Circular 230, any tax advice in this email may not be used to avoid any penalties imposed under U.S. tax laws. E-mail sent to or from this e-mail address may be monitored, reviewed and archived.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20140219/7ab6007d/attachment-0001.html
More information about the users
mailing list