SP fails with "Unable to establish security of incoming assertion"

[Wohlfarth, Robert J]

I am installing Shibboleth in front of an entire virtual host. When I go to any page on that host, Shibboleth redirects to the IdP login page. I enter the correct user name and password. Then the error message appears. I have worked on this for days with no success. I'm not sure what to try next. Can someone point me in the right direction?

The SP fails with the message "Unable to establish security of incoming assertion". The IdP tests okay with http://www.testshib.org<http://www.testshib.org/>. The IdP definitely has the SP's correct metadata. The SP runs under Ubuntu 12.04.1 LTS, Apache 2.2.22 using mod_shib_22.so.

What I've tried...

*         Google and mailing list archive searches mention the entityID's not matching or metadata not loaded.

o   The SP log file shows that the IdP metadata loaded successfully.

o   The SP's entityID exactly matches the entityID in the SAML response.

*         The IdP's entityID exactly matches the entityID in the SAML response.

*         The IdP's entityID in the metadata exactly matches the entityID in the SAML response.

*         The Issuer in the SAML response exactly matches the IdP's entityID.

*         If I add a <PolicyRule type="NullSecurity"/> then the SP authenticates and displays the protected web page.

*         Scoured DEBUG output in the log file for error messages or a hint of where the security checks fail.

Log file snippet. Note that I put the x's over the IdP name. The correct name does appear in the log file.

2014-02-19 11:18:53 DEBUG OpenSAML.MessageDecoder.SAML2 [1]: extracting issuer from SAML 2.0 protocol message
2014-02-19 11:18:53 DEBUG OpenSAML.MessageDecoder.SAML2 [1]: message from (https://xxxxxxxxxxxxxxx.xxxxxxxxxx.edu/idp/shibboleth)
2014-02-19 11:18:53 DEBUG OpenSAML.MessageDecoder.SAML2 [1]: searching metadata for message issuer...
2014-02-19 11:18:53 DEBUG OpenSAML.SecurityPolicyRule.MessageFlow [1]: evaluating message flow policy (replay checking on, expiration 60)
2014-02-19 11:18:53 DEBUG XMLTooling.StorageService [1]: inserted record (_6e663d6fc7ee7b3f8b960b0f36885d08) in context (MessageFlow) with expiration (1392830573)
2014-02-19 11:18:53 DEBUG XMLTooling.StorageService [1]: deleted record (c07e871eb7bf51aeddb65526c8201ffc) in context (RelayState)
2014-02-19 11:18:53 DEBUG Shibboleth.SSO.SAML2 [1]: processing message against SAML 2.0 SSO profile
2014-02-19 11:18:53 DEBUG Shibboleth.SSO.SAML2 [1]: extracting issuer from SAML 2.0 assertion
2014-02-19 11:18:53 DEBUG OpenSAML.SecurityPolicyRule.MessageFlow [1]: evaluating message flow policy (replay checking on, expiration 60)
2014-02-19 11:18:53 DEBUG XMLTooling.StorageService [1]: inserted record (_2f93eec68c6efb53c42b35968da713f9) in context (MessageFlow) with expiration (1392830573)
2014-02-19 11:18:53 DEBUG OpenSAML.SecurityPolicyRule.BearerConfirmation [1]: assertion satisfied bearer confirmation requirements
2014-02-19 11:18:53 WARN Shibboleth.SSO.SAML2 [1]: detected a problem with assertion: Unable to establish security of incoming assertion.
2014-02-19 11:18:53 DEBUG Shibboleth.Listener [2]: dispatching message (default/Login::run::SAML2SI)
2014-02-19 11:18:53 DEBUG XMLTooling.StorageService [2]: inserted record (3522f295d5ab2dc3e6b1f9081acbde0d) in context (RelayState) with expiration (1392830933)


Robert Wohlfarth
Computer Programmer/Analyst II | Center for Patient and Professional Advocacy
Vanderbilt University Medical Center | 2135 Blakemore Ave. | Nashville, TN 37212
Phone: 615-343-0828 | Fax: 615-343-8580
http://www.mc.vanderbilt.edu/centers/CPPA
Like<https://www.facebook.com/pages/Center-for-Patient-and-Professional-Advocacy-at-Vanderbilt/132537410163693?sk=wall> us on Facebook

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20140219/f8de5a81/attachment.html