Shibboleth SP 2.5.4 on Apache 2.4.10.1-64

[Cantor, Scott]

On 7/30/15, 12:42 PM, "users on behalf of Milligan, Jeff" <users-bounces at shibboleth.net on behalf of jeff.milligan at vce.com> wrote:



>  I have copied the logs for both a working validation and a broken one.  I'm not sure what could be the issue due to the seemingly randomness of the error below.

It's not random, it's undoubtedly a different IdP. If it's not, then that IdP has a bug.

As far as the error, the signature's bad, in the sense that the metadata you have doesn't contain the right key (or I guess in theory the IdP itself could be broken, but that's less likely). The PKIX part is interesting only insofar as it suggests the signature itself doesn't carry a KeyInfo, which is very unusual for the response leg, and suggests this is a weird IdP (which raises red flags in general).

>  As you can see below it worked 30 seconds before it didn't work.

Unless you only have one IdP in use, that doesn't follow.

-- Scott