Shibboleth IDP trust with other IDP

[krrishv]

HI,

I am trying to do a SAML POST to shibboleth IDP from other IDP and it always
says this message in browser.

Error Message: Message did not meet security requirements

and in the logs i see below

16:15:21.337 - DEBUG [org.opensaml.xml.signature.SignatureValidator:70] -
Signature validated with key from supplied credential
16:15:21.337 - DEBUG
[org.opensaml.xml.signature.impl.BaseSignatureTrustEngine:148] - Signature
validation using candidate credential was successful
16:15:21.337 - DEBUG
[org.opensaml.xml.signature.impl.BaseSignatureTrustEngine:101] -
Successfully verified signature using KeyInfo-derived credential
16:15:21.337 - DEBUG
[org.opensaml.xml.signature.impl.BaseSignatureTrustEngine:102] - Attempting
to establish trust of KeyInfo-derived credential
16:15:21.338 - DEBUG
[org.opensaml.xml.security.x509.BasicX509CredentialNameEvaluator:220] -
Supplied trusted names are null or empty, skipping name evaluation
16:15:21.338 - DEBUG
[org.opensaml.xml.signature.impl.PKIXSignatureTrustEngine:234] - Signature
trust could not be established via PKIX validation of signing credential
16:15:21.338 - DEBUG
[org.opensaml.xml.signature.impl.BaseSignatureTrustEngine:107] - Failed to
establish trust of KeyInfo-derived credential
16:15:21.338 - DEBUG
[org.opensaml.xml.signature.impl.BaseSignatureTrustEngine:115] - Failed to
verify signature and/or establish trust using any KeyInfo-derived
credentials
16:15:21.338 - DEBUG
[org.opensaml.xml.signature.impl.PKIXSignatureTrustEngine:162] - PKIX
validation of signature failed, unable to resolve valid and trusted signing
key
16:15:21.338 - DEBUG
[org.opensaml.common.binding.security.SAMLProtocolMessageXMLSignatureSecurityPolicyRule:136]
- Validation of protocol message signature failed for context issuer
'http://www.okta.com/k1u06zczTIHGIKYLIBHZ', message type:
{urn:oasis:names:tc:SAML:2.0:protocol}Response
16:15:21.348 - WARN
[edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler:406]
- Message did not meet security requirements
org.opensaml.ws.security.SecurityPolicyException: Validation of protocol
message signature failed
	at
org.opensaml.common.binding.security.SAMLProtocolMessageXMLSignatureSecurityPolicyRule.doEvaluate(SAMLProtocolMessageXMLSignatureSecurityPolicyRule.java:138)
~[opensaml-2.6.0.jar:na]
	at
org.opensaml.common.binding.security.SAMLProtocolMessageXMLSignatureSecurityPolicyRule.evaluate(SAMLProtocolMessageXMLSignatureSecurityPolicyRule.java:107)
~[opensaml-2.6.0.jar:na]
	at
org.opensaml.ws.security.provider.BasicSecurityPolicy.evaluate(BasicSecurityPolicy.java:51)
~[openws-1.5.0.jar:na]
	at
org.opensaml.ws.message.decoder.BaseMessageDecoder.processSecurityPolicy(BaseMessageDecoder.java:132)
~[openws-1.5.0.jar:na]
	at
org.opensaml.ws.message.decoder.BaseMessageDecoder.decode(BaseMessageDecoder.java:83)
~[openws-1.5.0.jar:na]
	at
org.opensaml.saml2.binding.decoding.BaseSAML2MessageDecoder.decode(BaseSAML2MessageDecoder.java:70)
~[opensaml-2.6.0.jar:na]
	at
edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.decodeRequest(SSOProfileHandler.java:386)
[shibboleth-identityprovider-2.4.0.jar:na]
	at
edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.performAuthentication(SSOProfileHandler.java:211)
[shibboleth-identityprovider-2.4.0.jar:na]
	at
edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.processRequest(SSOProfileHandler.java:189)
[shibboleth-identityprovider-2.4.0.jar:na]
	at
edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.processRequest(SSOProfileHandler.java:90)
[shibboleth-identityprovider-2.4.0.jar:na]
	at
edu.internet2.middleware.shibboleth.common.profile.ProfileRequestDispatcherServlet.service(ProfileRequestDispatcherServlet.java:83)
[shibboleth-common-1.4.0.jar:na]
	at javax.servlet.http.HttpServlet.service(HttpServlet.java:717)
[servlet-api.jar:na]
	at
org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290)
[catalina.jar:6.0.32]
	at
org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
[catalina.jar:6.0.32]
	at
edu.internet2.middleware.shibboleth.idp.util.NoCacheFilter.doFilter(NoCacheFilter.java:50)
[shibboleth-identityprovider-2.4.0.jar:na]
	at
org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
[catalina.jar:6.0.32]
	at
org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
[catalina.jar:6.0.32]
	at
edu.internet2.middleware.shibboleth.idp.session.IdPSessionFilter.doFilter(IdPSessionFilter.java:87)
[shibboleth-identityprovider-2.4.0.jar:na]
	at
org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
[catalina.jar:6.0.32]
	at
org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
[catalina.jar:6.0.32]
	at
edu.internet2.middleware.shibboleth.common.log.SLF4JMDCCleanupFilter.doFilter(SLF4JMDCCleanupFilter.java:52)
[shibboleth-common-1.4.0.jar:na]
	at
org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
[catalina.jar:6.0.32]
	at
org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
[catalina.jar:6.0.32]
	at
org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:233)
[catalina.jar:6.0.32]
	at
org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:191)
[catalina.jar:6.0.32]
	at
org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:127)
[catalina.jar:6.0.32]
	at
org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102)
[catalina.jar:6.0.32]
	at
org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109)
[catalina.jar:6.0.32]
	at
org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:298)
[catalina.jar:6.0.32]
	at
org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:859)
[tomcat-coyote.jar:6.0.32]
	at
org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process(Http11Protocol.java:588)
[tomcat-coyote.jar:6.0.32]
	at org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:489)
[tomcat-coyote.jar:6.0.32]
	at java.lang.Thread.run(Thread.java:744) [na:1.7.0_45]
16:15:21.429 - DEBUG
[edu.internet2.middleware.shibboleth.idp.util.HttpServletHelper:339] -
LoginContext key cookie was not present in request
16:15:21.429 - DEBUG
[edu.internet2.middleware.shibboleth.idp.ui.ServiceContactTag:177] - No
relying party, nothing to display
16:15:22.065 - DEBUG
[edu.internet2.middleware.shibboleth.idp.session.IdPSessionFilter:180] - No
session associated with session ID
ed737ba94bdf8241cd80839c20cf8c05c865cde8302d1e2411029de74de786bc - session
must have timed out


Appreciate your help



--
View this message in context: http://shibboleth.1660669.n2.nabble.com/Shibboleth-IDP-trust-with-other-IDP-tp7596134.html
Sent from the Shibboleth - Users mailing list archive at Nabble.com.