SP Requires Signed IdP Cert...

[Andrew Devenish-Meares]

Hi List,

We have a vendor who is insisting that we need to us a signed 
certificate for back-channel communications between their SP and our 
IdP.  We are running IdP 2.4.2.

We are members of the Australian Access Federation (AAF) which expects 
us to use self-signed certificate with long expiry (as seems to be the 
case for most federations).  After consultation, they suggested it 
should be possible to configure a second certificate for this specific 
provider.

I have a certificate for our test IdP, key and an an intermediate 
certificate.

In relying-party.xml I have configured a security:Credential:

     <security:Credential id="BilateralCredential" 
xsi:type="security:X509Filesystem">
 
<security:PrivateKey>/etc/pki/tls/private/idp-test.une.edu.au.key</security:PrivateKey>
         <security:Certificate 
entityCertificate="true">/etc/pki/tls/certs/idp-test_une_edu_au.crt</security:Certificate>
 
<security:Certificate>/etc/pki/tls/certs/QuoVadisIssuingCA2.crt</security:Certificate>
     </security:Credential>

In the RelyingParty for this SP we then use 
defaultSigningCredentialsRef="BilateralCredential".

Looking in the idp-process.log we can see that the data is sent with the 
certificate value from idp-test_une_edu_au.crt

          <ds:X509Data>
           <ds:X509Certificate>MIIGETCCBPmgAwIBAgIUYzyQCiqp2P1SOebqH
7zweWF+DngwDQYJKoZIhvcNAQELBQAwTTELMAkG....

But their SP fails to process the login with the error
"Message was signed, but signature could not be verified."
It would seem, as it's not logged, that the intermediate certificate 
isn't being presented.

I've tried putting both the server and intermediate certificates into 
the same file, which will verify on the command line with openssl, but 
this also fails to work.

Any suggestions, other than telling the vendor that they're being difficult?

Thanks

Andrew

-- 
Andrew Devenish-Meares
Solutions Analyst
Information Technology
University of New England
Armidale   NSW   2351

e:  adevenis at une.edu.au
p:  02 6773 4098
w: http://une.edu.au/itd