Shibboleth Idp 2.4.0 - Having issues changing Metadata

[Nate Klingenstein]

Ben,

TestShib uses file names to allow you to replace metadata that you had uploaded previously.  It's basically your tiny shared secret with TestShib.  If you uploaded the metadata again under a different file name with the same entityID, expect the unexpected because you will have two different copies of information for the same service.

If you don't know the file names that you used, please let me know and I'll go in there with the plunger.

Thanks,
Nate.

On Jul 8, 2014, at 1:05 PM, Ben Branch <BBranch at uco.edu<mailto:BBranch at uco.edu>> wrote:

All,

This is my very first Shibboleth installation and I had it working fine as of about 5 hours ago.  I had it working against the Testshib.org<http://Testshib.org> website without any issues.  I had been struggling to understand what people meant by “Updating the Metadata”.  I googled and googled till I finally found a site that discussed updating Idp metadata.  So, I did the following:

Made a backup of the /opt/shibboleth-idp/metadata/idp-metadata.xml
Made backups of the /opt/shibboleth-idp/credentials files (idp.crt, idp.key, and idp,jks).

Used the following to create a new X509 certificate/key:

# cat > idp-cert.cnf <<EOF
[req]
prompt=no
default_bits=2048
encrypt_key=no
default_md=sha1
distinguished_name=dn
# PrintableStrings only
string_mask=MASK:0002
x509_extensions=ext
[dn]
CN=casdev.uco.edu<http://casdev.uco.edu>
[ext]
subjectAltName=DNS:casdev.uco.edu,URI:https://casdev.uco.edu/idp/shibboleth<http://casdev.uco.edu/idp/shibboleth>
subjectKeyIdentifier=hash
EOF

openssl req -config idp-cert.cnf -new -x509 -keyout idp.new.key -out idp.new.crt 2> /dev/null

After creating the new crt and key files, I copied them into the /opt/shibboleth-idp/credentials directory and renamed them to the right names and double checked ownership of the files.   After renaming them, I did a “cat idp.crt” to get the X509 key and put that into my /opt/shibboleth-idp/metadata/idp-metadata.xml.  I then uploaded my metadata to testshib.org<http://testshib.org> to test and see if my new certs are working and now I am getting the following error messages in their log:

2014-07-08 14:29:42 ERROR OpenSAML.SecurityPolicyRule.XMLSigning [245]: unable to verify message signature with supplied trust engine
2014-07-08 14:29:42 WARN Shibboleth.SSO.SAML2 [245]: detected a problem with assertion: Message was signed, but signature could not be verified.

Additionally, I used the ./install.sh renew-cert to do this exact same thing, and I am still getting the same error message from testshib.org<http://testshib.org>and I have uploaded the metadata file multiple times now with no luck.  Is there something I’m missing?  Or am I just being stupid and missing the obvious?

Ben Branch
UNIX/Linux Administrator
University of Central Oklahoma
ITIL Foundation v3, Network+, RHCSA

100 N. University Drive, Box 122
Edmond, OK 73034
D: 405.974.2649 | M: 405.550.6804 | bbranch at uco.<mailto:bbranch at uco.>edu |www.uco.edu<http://www.uco.edu/>

“I am wiser than this man, for neither of us appears to know anything great and good; but he fancies he knows something, although he knows nothing; whereas I, as I do not know anything, so I do not fancy I do. In this trifling particular, then, I appear to be wiser than he, because I do not fancy I know what I do not know.”  - Socrates

**Bronze+Blue=Green** The University of Central Oklahoma is Bronze, Blue, and Green! Please print this e-mail only if absolutely necessary!

**CONFIDENTIALITY** -This e-mail (including any attachments) may contain confidential, proprietary and privileged information. Any unauthorized disclosure or use of this information is prohibited. --
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net<mailto:users-unsubscribe at shibboleth.net>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20140708/24dcf675/attachment-0001.html