Shibboleth 3 SAML Response Debugging

[McKean, Brandon Scott - mckeanbs]

Hi Everyone,

Continuing on with my efforts to get a working IDPv3 configuration,
I've been working on a bit of a hurdle with respect to supporting old
endpoints.

What I know is that the existing Shibboleth 2 install, is that it uses
Tomcat and is fronted by Apache. Through this setup it rewrites URL's
in an effort to maintain legacy URL paths, which to my understanding
are SAML1. The mapping is as follows:

/shibboleth-idp/SSO --> /idp/profile/Shibboleth/SSO

/shibboleth-idp/AA --> /idp/profile/SAML1/SOAP/AttributeQuery

Accordingly, I've configured Jetty's rewrite system to accomplish the
same. With those in place, I'm able to test existing service providers
to the point of logging in, approving attribute release, etc. However
at that point, they don't seem to like what they get from the new IDP.

The most meaningful data I could find stated the error was: Security of
SAML 1.x SSO POST response not established, this was from the SP.

I have Shibboleth running with debug logging on, and quite a bit seems
to happen up to the point of failure, though I'm not sure what I should
be looking for to troubleshoot.

For reference, I believe our metadata currently stipulates SAML1
endpoints are in use. I intend to address this as soon as I can but I
wanted to get IDPv3 up first. I can include that if desired.

Thanks for any guidance that can be given on this.

Regards,


-- 
Brandon McKean
IT / Systems
Linux Administrator
(540)568-4235
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20150715/526eb422/attachment-0001.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 5673 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/users/attachments/20150715/526eb422/attachment-0001.bin>