Shibboleth 3 SAML Response Debugging

[McKean, Brandon Scott - mckeanbs]

Hmm, I think I might have more information now, from testshib's log.
2015-07-16 11:10:01 DEBUG OpenSAML.SecurityPolicyRule.XMLSigning [75]:
validating signature profile
2015-07-16 11:10:01 DEBUG XMLTooling.KeyInfoResolver.Inline [75]:
resolving ds:X509Certificate
2015-07-16 11:10:01 DEBUG XMLTooling.KeyInfoResolver.Inline [75]:
resolved 1 certificate(s)
2015-07-16 11:10:01 DEBUG XMLTooling.KeyInfoResolver.Inline [75]:
resolved 0 CRL(s)
2015-07-16 11:10:01 DEBUG XMLTooling.TrustEngine.ExplicitKey [75]:
attempting to validate signature with the peer's credentials
2015-07-16 11:10:01 DEBUG XMLTooling.TrustEngine.ExplicitKey [75]:
signature validated with credential
2015-07-16 11:10:01 DEBUG OpenSAML.SecurityPolicyRule.XMLSigning [75]:
signature verified against message issuer
2015-07-16 11:10:01 DEBUG Shibboleth.SSO.SAML2 [75]: processing message
against SAML 2.0 SSO profile
2015-07-16 11:10:01 DEBUG XMLTooling.KeyInfoResolver.Inline [75]:
resolved 0 certificate(s)
2015-07-16 11:10:01 DEBUG XMLTooling.CredentialCriteria [75]: key
algorithm didn't match ('AES' != 'RSA')
2015-07-16 11:10:01 DEBUG XMLTooling.CredentialCriteria [75]: key
algorithm didn't match ('AES' != 'RSA')
2015-07-16 11:10:01 DEBUG XMLTooling.CredentialCriteria [75]: key
algorithm didn't match ('AES' != 'RSA')
2015-07-16 11:10:01 DEBUG XMLTooling.KeyInfoResolver.Inline [75]:
resolving ds:X509Certificate
2015-07-16 11:10:01 DEBUG XMLTooling.KeyInfoResolver.Inline [75]:
resolved 1 certificate(s)
2015-07-16 11:10:01 DEBUG XMLTooling.CredentialCriteria [75]:
credential name(s) didn't overlap
2015-07-16 11:10:01 DEBUG XMLTooling.CredentialCriteria [75]: keys
didn't match
This would reinforce what you said before about it being a credential
issue, but I'm not sure where that would be breaking down. The openssl
commands I did before verified idp-signing.key and idp-signing.crt
matched, and they are set as such in idp.properties.
Brandon
On Thu, 2015-07-16 at 14:20 +0000, Cantor, Scott wrote:
> On 7/16/15, 9:46 AM, "users on behalf of McKean, Brandon Scott -
> mckeanbs" <users-bounces at shibboleth.net on behalf of mckeanbs at jmu.edu
> > wrote:
> 
> > I think I've managed to get past this part, though now I'm getting
> > failures on more or less all SPs, though none of them are really
> > printing an error message to go on.
> 
> Without logs to go on, there's not much that can be determined.
> 
> If you need to set up an SP to test against to get logs yourself,
> then that would be your next step I guess, takes a few minutes if you
> have a spare VM handy.
> 
> > Perhaps you guys could look at the SAML assertion I'm getting and
> > point me in the right direction to fix this.
> 
> An obvious difference is that one is signed with rsa-sha1 and one is
> signed with rsa-sha256. The SP would have to be running on absolutely
> ancient software to not be able to handle that, but for the record,
> an SP running on, say, Red Hat 4, would in fact throw the error page
> you posted originally. My day will be immensely better if that turns
> out to be the case because I nourish myself on the tears of the
> damned.
> 
> -- Scott
> 
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20150716/4d67adb6/attachment.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 5673 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/users/attachments/20150716/4d67adb6/attachment.bin>