SP AuthnRequest - Signature size exceeded output buffer size

[Daniel Merchant]

I maintain a shibboleth Service Provider installation on Windows version
2.5.3.
We recently had a request to enable signed authentication requests for SP
initiated logon, which I am struggling to get working.
Seeing errors in the native.log:

2014-02-27 15:01:57 DEBUG Shibboleth.Listener [5036] isapi_shib_extension:
sending message (default/Login::run::ADFSSI)
2014-02-27 15:01:57 DEBUG Shibboleth.Listener [5036] isapi_shib_extension:
trying to connect to listener
2014-02-27 15:01:57 DEBUG Shibboleth.Listener [5036] isapi_shib_extension:
socket (452) connected successfully
2014-02-27 15:01:57 DEBUG Shibboleth.Listener [5036] isapi_shib_extension:
send completed, reading response message
2014-02-27 15:01:57 DEBUG Shibboleth.Listener [5036] isapi_shib_extension:
sending message (default/Login::run::SAML2SI)
2014-02-27 15:01:57 DEBUG Shibboleth.Listener [5036] isapi_shib_extension:
send completed, reading response message
2014-02-27 15:01:57 ERROR Shibboleth.Listener [5036] isapi_shib_extension:
remoted message returned an error: Signature size exceeded output buffer
size.
2014-02-27 15:01:57 ERROR Shibboleth.ISAPI [5036] isapi_shib_extension:
Signature size exceeded output buffer size.

On the web page error is:

Error Details:
xmltooling::XMLToolingException
The system encountered an error at Thu Feb 27 15:54:57 2014
xmltooling::XMLToolingException at (
https://myServiceprovider.mydomain.com/Shibboleth.sso/Login)


Signature size exceeded output buffer size.

We are using a larger than normal CA certificate (8192 bits) by requirement
of the IDP.  Using a self-signed 2048 bit cert to sign the authn request
works fine.  Turning off authentication request signing also works fine.
I expect there is a setting where I need to increase a buffer size value
but I have done a lot of Googling, checked through all the documentation
that seems relevant and can not find this anywhere.

Does anyone have any advice?  Is it just not supported to have a 8192 bit
cert to sign SAML 2 authentication requests?  I can see 2048 bits for SP
certificates is recommended in a lot of places, but not hard limits.

Many thanks,

Daniel
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20140227/418d4f2c/attachment.html