unable to verify message signature with supplied trust engine
Mike Flynn
shibbolethlynda at yahoo.com
Wed Jun 3 15:23:57 EDT 2015
I ran across this once before but it was a cert mismatch. The logs show this:
2015-06-03 12:06:22 DEBUG XMLTooling.TrustEngine.ExplicitKey [19]: attempting to validate signature with the peer's credentials2015-06-03 12:06:22 DEBUG XMLTooling.TrustEngine.ExplicitKey [19]: public key did not validate signature: Digital signature does not validate with the supplied key.2015-06-03 12:06:22 DEBUG XMLTooling.TrustEngine.ExplicitKey [19]: no peer credentials validated the signature2015-06-03 12:06:22 ERROR OpenSAML.SecurityPolicyRule.XMLSigning [19]: unable to verify message signature with supplied trust engine
the metadata is this:
<md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"xmlns:ds="http://www.w3.org/2000/09/xmldsig#"entityID="https://saml.aetn.org/simplesaml/saml2/idp/metadata.php"> <md:IDPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol"> <md:KeyDescriptor use="signing"> <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#"> <ds:X509Data> <ds:X509Certificate> MIIFUDCCBDigAwIBAgIQTx/e0KtWbz/DSeOg5ON2rjANBgkqhkiG9w0BAQsFADB6MQswCQYDVQQGEwJVUzELMAkGA1UECBMCVkExEDAOBgNVBAcTB0hlcm5kb24xITAfBgNVBAoTGE5ldHdvcmsgU29sdXRpb25zIEwuTC5DLjEpMCcGA1UEAxMgTmV0d29yayBTb2x1dGlvbnMgRFYgU2VydmVyIENBIDIwHhcNMTUwNTEzMDAwMDAwWhcNMTUwOTI3MjM1OTU5WjBdMSEwHwYDVQQLExhEb21haW4gQ29udHJvbCBWYWxpZGF0ZWQxIDAeBgNVBAsTF25zUHJvdGVjdCBTZWN1cmUgWHByZXNzMRYwFAYDVQQDEw1zYW1sLmFldG4ub3JnMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA3bafrapylk/+62zL5jG9U2otBM+Rtmw2XWpBfh6dPUEe5+SAma+mqv0iFEachmQVKje/BVAU/oGZucBsyO3yivz/vikORvsB5dmZaNuY07uLvNRZatL8iZaqWDKU+Xdlb884dGx8FJwesvI/Kj7oRPodQfmfWYy3ohBAIGUoPYULtRAktgdv2a9mOtNau+9hkIKrHS0FxFC0IGMS34KLHKA4lOnZWhTP4TMHJqGfo0QOCW/EF2nkQJ6rhsLMk/gK9K7pj993E3S1WGc1OVAb84v/XSyncy02waYgIU4MgukApxD1FsFNR/i5LEoyJzVrQ1vrWlrjAMF5cUQ+GPnMjQIDAQABo4IB7TCCAekwHwYDVR0jBBgwFoAUUc7fVB23LFeraGFIAhrTsoXsQKowHQYDVR0OBBYEFNlM1erl6RBCLysmI0XE/HRnhgqDMA4GA1UdDwEB/wQEAwIFoDAMBgNVHRMBAf8EAjAAMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjB1BgNVHSAEbjBsMGAGDCsGAQQBhg4BAgEJATBQME4GCCsGAQUFBwIBFkJodHRwOi8vd3d3Lm5ldHdvcmtzb2x1dGlvbnMuY29tL2xlZ2FsL1NTTC1sZWdhbC1yZXBvc2l0b3J5LWNwcy5qc3AwCAYGZ4EMAQIBMEkGA1UdHwRCMEAwPqA8oDqGOGh0dHA6Ly9jcmwubmV0c29sc3NsLmNvbS9OZXR3b3JrU29sdXRpb25zRFZTZXJ2ZXJDQTIuY3JsMHsGCCsGAQUFBwEBBG8wbTBEBggrBgEFBQcwAoY4aHR0cDovL2NydC5uZXRzb2xzc2wuY29tL05ldHdvcmtTb2x1dGlvbnNEVlNlcnZlckNBMi5jcnQwJQYIKwYBBQUHMAGGGWh0dHA6Ly9vY3NwLm5ldHNvbHNzbC5jb20wKwYDVR0RBCQwIoINc2FtbC5hZXRuLm9yZ4IRd3d3LnNhbWwuYWV0bi5vcmcwDQYJKoZIhvcNAQELBQADggEBAAt1lN3VnW+5A4Js3jKFE1ebjZAQB/WDEBpHetCy1xW91/QksHUb1oxFu/MpH1Lsye4XR8C2agI3itPbjD7l5Os4XZtdSBhL7g3BSWJw38g4aDp+qOlbireACn1rG2GiN1zDGTL2E7900ZIizfpJfkbcrL4wW9qzg4Jrn8y+QxjZZwAzD/qamqWPVd+pp2Smpdp+SD5Z37KV5W096YTwGja1rn2oHGipC0bGUFHOWZTkU8iyC6ksTlaEVbl7jiGjX2g3Ws8nbFS2Wi6bewbTXcis/jNIL979oT20jkW/nKxKYX8ADHTaVslcJnwHuxEI4bBPw99cd6eJDp5nkwdDQmo=</ds:X509Certificate> </ds:X509Data> </ds:KeyInfo> </md:KeyDescriptor> <md:KeyDescriptor use="encryption"> <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#"> <ds:X509Data> <ds:X509Certificate> MIIFUDCCBDigAwIBAgIQTx/e0KtWbz/DSeOg5ON2rjANBgkqhkiG9w0BAQsFADB6MQswCQYDVQQGEwJVUzELMAkGA1UECBMCVkExEDAOBgNVBAcTB0hlcm5kb24xITAfBgNVBAoTGE5ldHdvcmsgU29sdXRpb25zIEwuTC5DLjEpMCcGA1UEAxMgTmV0d29yayBTb2x1dGlvbnMgRFYgU2VydmVyIENBIDIwHhcNMTUwNTEzMDAwMDAwWhcNMTUwOTI3MjM1OTU5WjBdMSEwHwYDVQQLExhEb21haW4gQ29udHJvbCBWYWxpZGF0ZWQxIDAeBgNVBAsTF25zUHJvdGVjdCBTZWN1cmUgWHByZXNzMRYwFAYDVQQDEw1zYW1sLmFldG4ub3JnMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA3bafrapylk/+62zL5jG9U2otBM+Rtmw2XWpBfh6dPUEe5+SAma+mqv0iFEachmQVKje/BVAU/oGZucBsyO3yivz/vikORvsB5dmZaNuY07uLvNRZatL8iZaqWDKU+Xdlb884dGx8FJwesvI/Kj7oRPodQfmfWYy3ohBAIGUoPYULtRAktgdv2a9mOtNau+9hkIKrHS0FxFC0IGMS34KLHKA4lOnZWhTP4TMHJqGfo0QOCW/EF2nkQJ6rhsLMk/gK9K7pj993E3S1WGc1OVAb84v/XSyncy02waYgIU4MgukApxD1FsFNR/i5LEoyJzVrQ1vrWlrjAMF5cUQ+GPnMjQIDAQABo4IB7TCCAekwHwYDVR0jBBgwFoAUUc7fVB23LFeraGFIAhrTsoXsQKowHQYDVR0OBBYEFNlM1erl6RBCLysmI0XE/HRnhgqDMA4GA1UdDwEB/wQEAwIFoDAMBgNVHRMBAf8EAjAAMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjB1BgNVHSAEbjBsMGAGDCsGAQQBhg4BAgEJATBQME4GCCsGAQUFBwIBFkJodHRwOi8vd3d3Lm5ldHdvcmtzb2x1dGlvbnMuY29tL2xlZ2FsL1NTTC1sZWdhbC1yZXBvc2l0b3J5LWNwcy5qc3AwCAYGZ4EMAQIBMEkGA1UdHwRCMEAwPqA8oDqGOGh0dHA6Ly9jcmwubmV0c29sc3NsLmNvbS9OZXR3b3JrU29sdXRpb25zRFZTZXJ2ZXJDQTIuY3JsMHsGCCsGAQUFBwEBBG8wbTBEBggrBgEFBQcwAoY4aHR0cDovL2NydC5uZXRzb2xzc2wuY29tL05ldHdvcmtTb2x1dGlvbnNEVlNlcnZlckNBMi5jcnQwJQYIKwYBBQUHMAGGGWh0dHA6Ly9vY3NwLm5ldHNvbHNzbC5jb20wKwYDVR0RBCQwIoINc2FtbC5hZXRuLm9yZ4IRd3d3LnNhbWwuYWV0bi5vcmcwDQYJKoZIhvcNAQELBQADggEBAAt1lN3VnW+5A4Js3jKFE1ebjZAQB/WDEBpHetCy1xW91/QksHUb1oxFu/MpH1Lsye4XR8C2agI3itPbjD7l5Os4XZtdSBhL7g3BSWJw38g4aDp+qOlbireACn1rG2GiN1zDGTL2E7900ZIizfpJfkbcrL4wW9qzg4Jrn8y+QxjZZwAzD/qamqWPVd+pp2Smpdp+SD5Z37KV5W096YTwGja1rn2oHGipC0bGUFHOWZTkU8iyC6ksTlaEVbl7jiGjX2g3Ws8nbFS2Wi6bewbTXcis/jNIL979oT20jkW/nKxKYX8ADHTaVslcJnwHuxEI4bBPw99cd6eJDp5nkwdDQmo=</ds:X509Certificate> </ds:X509Data> </ds:KeyInfo> </md:KeyDescriptor> <md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://saml.aetn.org/simplesaml/saml2/idp/SingleLogoutService.php" /> <md:NameIDFormat> urn:oasis:names:tc:SAML:2.0:nameid-format:transient</md:NameIDFormat> <md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://saml.aetn.org/simplesaml/saml2/idp/SSOService.php" /> </md:IDPSSODescriptor> <md:ContactPerson contactType="technical"> <md:SurName>Administrator</md:SurName> <md:EmailAddress>admin at aetn.org</md:EmailAddress> </md:ContactPerson></md:EntityDescriptor>
And the assertion is this:
<samlp:Response xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"ID="_395fd481c90419a4d1eb362f4830c89b9cecb32ab1" Version="2.0"IssueInstant="2015-06-03T19:06:22Z"Destination="https://shib.release.lynda.com/Shibboleth.sso/SAML2/POST"InResponseTo="_8cfc2a4c764649134de365fcc80a7f78"> <saml:Issuer> https://saml.aetn.org/simplesaml/saml2/idp/metadata.php</saml:Issuer> <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#"> <ds:SignedInfo> <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /> <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /> <ds:Reference URI="#_395fd481c90419a4d1eb362f4830c89b9cecb32ab1">
<ds:Transforms> <ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /> <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /> </ds:Transforms> <ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /> <ds:DigestValue> lqYDyvlmCN26bTWmRYBHW50bhUQ=</ds:DigestValue> </ds:Reference> </ds:SignedInfo> <ds:SignatureValue> sKZV44VRE6wmcA0IY/IlC7USU9J1piUSsvt08VUrAtVW3zboDy4fASgjfMD1USmm3qLOtDBRXWx67zONMuGu2mdUAPD1tmEJJWfyR2d9IUXPrPlUoBK7EAiVHLZYBSDHmjNUPHzrJWeydDQ12qDF0sszU3Tv17/hUeaEEh3QTgYxXZvPbRy9oP7hVgpWjSEBrH9gS53+3VNw/LEJr9Aen69G9T8yZ1m/lKMHImfA1pRvnkY1t5VDgVARr4MQobUnyRVIgEXmSri05IUXkNm74bDX2yPkW26BAf0gUm1h6FCYXEeIfp3hE9c/CxVA44hTwo3EEj6H16tZcSmQOF1zFw==</ds:SignatureValue> <ds:KeyInfo> <ds:X509Data> <ds:X509Certificate> MIIFUDCCBDigAwIBAgIQTx/e0KtWbz/DSeOg5ON2rjANBgkqhkiG9w0BAQsFADB6MQswCQYDVQQGEwJVUzELMAkGA1UECBMCVkExEDAOBgNVBAcTB0hlcm5kb24xITAfBgNVBAoTGE5ldHdvcmsgU29sdXRpb25zIEwuTC5DLjEpMCcGA1UEAxMgTmV0d29yayBTb2x1dGlvbnMgRFYgU2VydmVyIENBIDIwHhcNMTUwNTEzMDAwMDAwWhcNMTUwOTI3MjM1OTU5WjBdMSEwHwYDVQQLExhEb21haW4gQ29udHJvbCBWYWxpZGF0ZWQxIDAeBgNVBAsTF25zUHJvdGVjdCBTZWN1cmUgWHByZXNzMRYwFAYDVQQDEw1zYW1sLmFldG4ub3JnMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA3bafrapylk/+62zL5jG9U2otBM+Rtmw2XWpBfh6dPUEe5+SAma+mqv0iFEachmQVKje/BVAU/oGZucBsyO3yivz/vikORvsB5dmZaNuY07uLvNRZatL8iZaqWDKU+Xdlb884dGx8FJwesvI/Kj7oRPodQfmfWYy3ohBAIGUoPYULtRAktgdv2a9mOtNau+9hkIKrHS0FxFC0IGMS34KLHKA4lOnZWhTP4TMHJqGfo0QOCW/EF2nkQJ6rhsLMk/gK9K7pj993E3S1WGc1OVAb84v/XSyncy02waYgIU4MgukApxD1FsFNR/i5LEoyJzVrQ1vrWlrjAMF5cUQ+GPnMjQIDAQABo4IB7TCCAekwHwYDVR0jBBgwFoAUUc7fVB23LFeraGFIAhrTsoXsQKowHQYDVR0OBBYEFNlM1erl6RBCLysmI0XE/HRnhgqDMA4GA1UdDwEB/wQEAwIFoDAMBgNVHRMBAf8EAjAAMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjB1BgNVHSAEbjBsMGAGDCsGAQQBhg4BAgEJATBQME4GCCsGAQUFBwIBFkJodHRwOi8vd3d3Lm5ldHdvcmtzb2x1dGlvbnMuY29tL2xlZ2FsL1NTTC1sZWdhbC1yZXBvc2l0b3J5LWNwcy5qc3AwCAYGZ4EMAQIBMEkGA1UdHwRCMEAwPqA8oDqGOGh0dHA6Ly9jcmwubmV0c29sc3NsLmNvbS9OZXR3b3JrU29sdXRpb25zRFZTZXJ2ZXJDQTIuY3JsMHsGCCsGAQUFBwEBBG8wbTBEBggrBgEFBQcwAoY4aHR0cDovL2NydC5uZXRzb2xzc2wuY29tL05ldHdvcmtTb2x1dGlvbnNEVlNlcnZlckNBMi5jcnQwJQYIKwYBBQUHMAGGGWh0dHA6Ly9vY3NwLm5ldHNvbHNzbC5jb20wKwYDVR0RBCQwIoINc2FtbC5hZXRuLm9yZ4IRd3d3LnNhbWwuYWV0bi5vcmcwDQYJKoZIhvcNAQELBQADggEBAAt1lN3VnW+5A4Js3jKFE1ebjZAQB/WDEBpHetCy1xW91/QksHUb1oxFu/MpH1Lsye4XR8C2agI3itPbjD7l5Os4XZtdSBhL7g3BSWJw38g4aDp+qOlbireACn1rG2GiN1zDGTL2E7900ZIizfpJfkbcrL4wW9qzg4Jrn8y+QxjZZwAzD/qamqWPVd+pp2Smpdp+SD5Z37KV5W096YTwGja1rn2oHGipC0bGUFHOWZTkU8iyC6ksTlaEVbl7jiGjX2g3Ws8nbFS2Wi6bewbTXcis/jNIL979oT20jkW/nKxKYX8ADHTaVslcJnwHuxEI4bBPw99cd6eJDp5nkwdDQmo=</ds:X509Certificate> </ds:X509Data> </ds:KeyInfo> </ds:Signature> <samlp:Status> <samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" /> </samlp:Status> <saml:Assertion xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xs="http://www.w3.org/2001/XMLSchema" ID="_2366b52c6d3d1330cea3633bb79aa0d18647040867" Version="2.0" IssueInstant="2015-06-03T19:06:22Z"> <saml:Issuer> https://saml.aetn.org/simplesaml/saml2/idp/metadata.php</saml:Issuer> <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#"> <ds:SignedInfo> <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /> <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /> <ds:Reference URI="#_2366b52c6d3d1330cea3633bb79aa0d18647040867">
<ds:Transforms> <ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /> <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /> </ds:Transforms> <ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /> <ds:DigestValue> 1UOa1hi7XHUUvE0l53XTmjnX5yA=</ds:DigestValue> </ds:Reference> </ds:SignedInfo> <ds:SignatureValue> ExEMmUsPYSVZ+yBGRo+Iyd+qntC0UJaDy685RkIrfr8hJjR2o0Ty247JfDv4H2/zavD4I+eY0q/pAJJo8mZxWQ7+fKVPm2TlB3F8/17eDo9phHEPwYJ0NucViaeKi46Hom3oMKHQ5DUGYKj4uyXDH7LnhI5VZpQHu1Dz2JFM6NAOSaizsfq7DWj3TAViV+7ZhcMade2WuUt68clLUAW0keSuv9iAxwZV5QjBjdWi4tcezw4hKfc7btZgcyUj3XB3EABSwkpFn7RRFB5itRq8LSB1uVjqlvLRjwQp5RwqlJ+0W6Esih6P5XQBP79AJcw5ynWLpWnwkSbAUxO0b8mlRg==</ds:SignatureValue> <ds:KeyInfo> <ds:X509Data> <ds:X509Certificate> MIIFUDCCBDigAwIBAgIQTx/e0KtWbz/DSeOg5ON2rjANBgkqhkiG9w0BAQsFADB6MQswCQYDVQQGEwJVUzELMAkGA1UECBMCVkExEDAOBgNVBAcTB0hlcm5kb24xITAfBgNVBAoTGE5ldHdvcmsgU29sdXRpb25zIEwuTC5DLjEpMCcGA1UEAxMgTmV0d29yayBTb2x1dGlvbnMgRFYgU2VydmVyIENBIDIwHhcNMTUwNTEzMDAwMDAwWhcNMTUwOTI3MjM1OTU5WjBdMSEwHwYDVQQLExhEb21haW4gQ29udHJvbCBWYWxpZGF0ZWQxIDAeBgNVBAsTF25zUHJvdGVjdCBTZWN1cmUgWHByZXNzMRYwFAYDVQQDEw1zYW1sLmFldG4ub3JnMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA3bafrapylk/+62zL5jG9U2otBM+Rtmw2XWpBfh6dPUEe5+SAma+mqv0iFEachmQVKje/BVAU/oGZucBsyO3yivz/vikORvsB5dmZaNuY07uLvNRZatL8iZaqWDKU+Xdlb884dGx8FJwesvI/Kj7oRPodQfmfWYy3ohBAIGUoPYULtRAktgdv2a9mOtNau+9hkIKrHS0FxFC0IGMS34KLHKA4lOnZWhTP4TMHJqGfo0QOCW/EF2nkQJ6rhsLMk/gK9K7pj993E3S1WGc1OVAb84v/XSyncy02waYgIU4MgukApxD1FsFNR/i5LEoyJzVrQ1vrWlrjAMF5cUQ+GPnMjQIDAQABo4IB7TCCAekwHwYDVR0jBBgwFoAUUc7fVB23LFeraGFIAhrTsoXsQKowHQYDVR0OBBYEFNlM1erl6RBCLysmI0XE/HRnhgqDMA4GA1UdDwEB/wQEAwIFoDAMBgNVHRMBAf8EAjAAMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjB1BgNVHSAEbjBsMGAGDCsGAQQBhg4BAgEJATBQME4GCCsGAQUFBwIBFkJodHRwOi8vd3d3Lm5ldHdvcmtzb2x1dGlvbnMuY29tL2xlZ2FsL1NTTC1sZWdhbC1yZXBvc2l0b3J5LWNwcy5qc3AwCAYGZ4EMAQIBMEkGA1UdHwRCMEAwPqA8oDqGOGh0dHA6Ly9jcmwubmV0c29sc3NsLmNvbS9OZXR3b3JrU29sdXRpb25zRFZTZXJ2ZXJDQTIuY3JsMHsGCCsGAQUFBwEBBG8wbTBEBggrBgEFBQcwAoY4aHR0cDovL2NydC5uZXRzb2xzc2wuY29tL05ldHdvcmtTb2x1dGlvbnNEVlNlcnZlckNBMi5jcnQwJQYIKwYBBQUHMAGGGWh0dHA6Ly9vY3NwLm5ldHNvbHNzbC5jb20wKwYDVR0RBCQwIoINc2FtbC5hZXRuLm9yZ4IRd3d3LnNhbWwuYWV0bi5vcmcwDQYJKoZIhvcNAQELBQADggEBAAt1lN3VnW+5A4Js3jKFE1ebjZAQB/WDEBpHetCy1xW91/QksHUb1oxFu/MpH1Lsye4XR8C2agI3itPbjD7l5Os4XZtdSBhL7g3BSWJw38g4aDp+qOlbireACn1rG2GiN1zDGTL2E7900ZIizfpJfkbcrL4wW9qzg4Jrn8y+QxjZZwAzD/qamqWPVd+pp2Smpdp+SD5Z37KV5W096YTwGja1rn2oHGipC0bGUFHOWZTkU8iyC6ksTlaEVbl7jiGjX2g3Ws8nbFS2Wi6bewbTXcis/jNIL979oT20jkW/nKxKYX8ADHTaVslcJnwHuxEI4bBPw99cd6eJDp5nkwdDQmo=</ds:X509Certificate> </ds:X509Data> </ds:KeyInfo> </ds:Signature> <saml:Subject> <saml:NameID SPNameQualifier="https://shib.release.lynda.com/shibboleth-sp" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient"> _e39b02f49a03e51c951c3c08a440a738d1fc486f7a</saml:NameID> <saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
<saml:SubjectConfirmationData NotOnOrAfter="2015-06-03T19:11:22Z" Recipient="https://shib.release.lynda.com/Shibboleth.sso/SAML2/POST" InResponseTo="_8cfc2a4c764649134de365fcc80a7f78" /> </saml:SubjectConfirmation> </saml:Subject> <saml:Conditions NotBefore="2015-06-03T19:05:52Z" NotOnOrAfter="2015-06-03T19:11:22Z"> <saml:AudienceRestriction> <saml:Audience> https://shib.release.lynda.com/shibboleth-sp</saml:Audience> </saml:AudienceRestriction> </saml:Conditions> <saml:AuthnStatement AuthnInstant="2015-06-03T19:06:06Z" SessionNotOnOrAfter="2015-06-04T03:06:22Z" SessionIndex="_0b4c60dedabede001cdd0dfee6131ce2eb2e5eb317"> <saml:AuthnContext> <saml:AuthnContextClassRef> urn:oasis:names:tc:SAML:2.0:ac:classes:Password</saml:AuthnContextClassRef> </saml:AuthnContext> </saml:AuthnStatement> <saml:AttributeStatement> <saml:Attribute Name="urn:oid:2.5.4.4" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"> <saml:AttributeValue xsi:type="xs:string"> Barber</saml:AttributeValue> </saml:Attribute> <saml:Attribute Name="urn:oid:0.9.2342.19200300.100.1.3" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"> <saml:AttributeValue xsi:type="xs:string"> gbarber at aetn.org</saml:AttributeValue> </saml:Attribute> <saml:Attribute Name="urn:oid:2.5.4.42" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"> <saml:AttributeValue xsi:type="xs:string"> Greg</saml:AttributeValue> </saml:Attribute> </saml:AttributeStatement> </saml:Assertion></samlp:Response>
So the certs match and the cert is valid (checked it with the SSLShopper tool). What am I missing here?
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20150603/55c5115a/attachment-0001.html>
More information about the users
mailing list