Signed AuthnRequest

[Vasu Y]

Hi,
 My SP is sending a signed AuthnRequest, but at shibboleth IDP end, i see errors.
AuthnRequests that are not signed are working fine. Also signed Logout Requests seems to work fine.

I have taken care of the following settings before trying out signed AuthnRequest.
1) AuthnRequestsSigned="true" in SPSSODescriptor.
2) I also tried adding "<security:Rule xsi:type="security:MandatoryMessageAuthentication"/>" to "SAML2SSOSecurityPolicy" in relying-party.xml
 
Here is the error from idp-process.log:
-------------------------------------
 17:26:38.627 - WARN [edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler:406] - Message did not meet security requirements
 org.opensaml.xml.security.SecurityException: SAML message intended destination (required by binding) was not present
 at org.opensaml.common.binding.decoding.BaseSAMLMessageDecoder.checkEndpointURI(BaseSAMLMessageDecoder.java:201) ~[opensaml-2.6.0.jar:na]
 at org.opensaml.saml2.binding.decoding.BaseSAML2MessageDecoder.decode(BaseSAML2MessageDecoder.java:72) ~[opensaml-2.6.0.jar:na]
 at edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.decodeRequest(SSOProfileHandler.java:386) [shibboleth-identityprovider-2.4.0.jar:na]
 at edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.performAuthentication(SSOProfileHandler.java:211) [shibboleth-identityprovider-2.4.0.jar:na]
 at edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.processRequest(SSOProfileHandler.java:189) [shibboleth-identityprovider-2.4.0.jar:na]
at edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.processRequest(SSOProfileHandler.java:90) [shibboleth-identityprovider-2.4.0.jar:na]
 

Here is the signed AuthnRequest from IDP's idp-process.log:
-----------------------------------------------------------
 <?xml version="1.0" encoding="UTF-8"?><saml2p:AuthnRequest xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol" AssertionConsumerServiceURL="http://inw00003973:16006/ma/acs/knWkUYo8" ID="e7d83752-69ed-4b50-8125-6628a584e5fc" IssueInstant="2014-03-20T11:56:38.216Z" ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Version="2.0">
    <saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">http://knWkUYo8.inw00003973:16006</saml2:Issuer>
    <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
       <ds:SignedInfo>
          <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
          <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
          <ds:Reference URI="#e7d83752-69ed-4b50-8125-6628a584e5fc">
             <ds:Transforms>
                <ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
                <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
             </ds:Transforms>
             <ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
             <ds:DigestValue>Rl7TSyGsbyge/IsU3c6SCQpN7/s=</ds:DigestValue>
          </ds:Reference>
       </ds:SignedInfo>
       <ds:SignatureValue>ePDcuSrQAu05J+uoPtpovnj587RKy+ivV7mXpRgi2pBk02KHNqU4PN7oGsyM/9MJR0ZnaA/SXUjHyVFxlcKLFWOe40U1v1iE48V3EzaaN3Xlzw9DUK+pLatXs09Yj5TlNSobiTW22rH5crasH2XzwxiJXzFwHAsGnRsn3HbLMfzzG5pkQ3+GZdRYDzwi/CGrLQGUuzlGH+37EJVYP/N07nqsi/MKRz4x0eOYB0GQZO9MaoFhRDJNec2tPVXnbf0IbsJpx2hzar8Ipa3mdCV+gFvJyhy9WPeGNiIObHAN7C2cZCECMqjGB1md49AmSxyoUiihDTa1y9VU60IRZJivzQ==</ds:SignatureValue>
    </ds:Signature>
    <saml2p:NameIDPolicy Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress" xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol"/>
</saml2p:AuthnRequest>

Any clues how this can be fixed?

Thanks,
Vasu
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20140320/67ce5f3f/attachment.html