Error Message with IdP "LoginContext key cookie was not present in request"

[Cantor, Scott]

On 1/4/14, 6:46 PM, "Mike Flynn" <shibbolethlynda at yahoo.com> wrote:

>When the error was reported to me by a user at the school I assumed that
>the school's cert had changed and apprised Ryan about it.  Ryan said no
>change had occurred so I sent him a copy of the metadata I had for their
>IdP.  Ryan said the copy I had matched his production version.  Ryan sent
>me his current production metadata and I checked it as well and it
>matched.  I loaded the copy that Ryan sent to me to my production servers
>but still the issue persists...

The problem is that comparing any metadata to any other metadata doesn't
really matter, and it certainly doesn't matter in any way shape or form
what metadata is *on* the IdP. That's entirely irrelevant.

If you have a piece of metadata that is known to successfully provision a
working SP, that means something, but there's no such thing as production
metadata in and of itself. Metadata just describes present configuration,
and if it doesn't work, then the present configuration doesn't match the
metadata in use.

The bottom line is that the only way to compare anything is to evaluate
what the public key in the signature actually is, and then what's in the
metadata on your end. That's the only thing that matters.

The only other conceivable breaking change is to change the entityID on
the IdP to something that is still in the metadata at the SP but points to
a different key.

-- Scott