Another SecurityException: Could not resolve key encryption credential

[Chris Hall]

I've seen this error on a few occasions looking back through Google and the
resolution has often been certificate regeneration, or entityID mis-match
etc.

This is my second setup - having configured correctly using my local
machine, but moving to an Amazon AWS instance I cannot get past this issue.
Log entries:

06:00:47.357 - ERROR
[edu.internet2.middleware.shibboleth.idp.profile.saml2.AbstractSAML2ProfileHandler:927]
- Could not resolve a key encryption credential for peer entity:
https://jci.projectcue.technology/shibboleth
06:00:47.357 - ERROR
[edu.internet2.middleware.shibboleth.idp.profile.saml2.AbstractSAML2ProfileHandler:289]
- Unable to construct encrypter
org.opensaml.xml.security.SecurityException: Could not resolve key
encryption credential
	at edu.internet2.middleware.shibboleth.idp.profile.saml2.AbstractSAML2ProfileHandler.getEncrypter(AbstractSAML2ProfileHandler.java:928)
~[shibboleth-identityprovider-2.4.0.jar:na]


And metadata uploaded to testshib:


<md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
ID="_d515bcc288e5df92e95c5973cee5fd2d4a302d4f"
entityID="https://jci.projectcue.technology/shibboleth">

  <md:Extensions xmlns:alg="urn:oasis:names:tc:SAML:metadata:algsupport">

    <alg:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha512"/>

...

    <alg:SigningMethod
Algorithm="http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha512"/>

...

  </md:Extensions>

  <md:SPSSODescriptor
protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol
urn:oasis:names:tc:SAML:1.1:protocol
urn:oasis:names:tc:SAML:1.0:protocol">

    <md:Extensions>

      <init:RequestInitiator
xmlns:init="urn:oasis:names:tc:SAML:profiles:SSO:request-init"
Binding="urn:oasis:names:tc:SAML:profiles:SSO:request-init"
Location="https://jci.projectcue.technology/Shibboleth.sso/Login"/>

    </md:Extensions>

    <md:KeyDescriptor>

      <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">

        <ds:KeyName>ip-172-31-13-44.us-west-2.compute.internal</ds:KeyName>

        <ds:X509Data>

          <ds:X509SubjectName>CN=ip-172-31-13-44.us-west-2.compute.internal</ds:X509SubjectName>

          <ds:X509Certificate>MIIDRTCCAi2gAw

...

</ds:X509Certificate>

        </ds:X509Data>

      </ds:KeyInfo>

gives me the Unable to encrypt Assertion response.

Can anyone shed any light on why the MetadataCredentialResolver can't
resolve a credential for my entityID?


Chris
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20150409/1ce1f9d2/attachment-0001.html