Connection between a SP and a new Shibboleth IdP

[Esther Garcia]

Hello,

We have installed a Shibboleth IdP (version 2.4.4) following this procedure:

https://wiki.shibboleth.net/confluence/display/SHIB2/IdPInstall

The servlet container used is Jetty 9.2. If we run a quick test we receive
an "ok" page indicating that the IdP is properly installed and running.

But if we try to connect from a SP to our new Shibboleth Idp, we receive
the following error: *"Message did not meet security requirements"*.

It seems a problem with the certificate configuration, but we do not see
the problem. I would like to ask if you can help to understand this problem.

Here our certificate configuration:

Certificates are located in IDP_HOME/credentials:


*~]# ls /opt/shibboleth-idp/credentials/idp.crt  idp.jks  idp.key  idp.p12*

In IDP_HOME/conf/relying-party.xml we have the following config:


* <security:Credential id="IdPCredential"
xsi:type="security:X509Filesystem">*


*<security:Certificate>/opt/shibboleth-idp/credentials/idp.crt</security:Certificate><security:PrivateKey>/opt/shibboleth-idp/credentials/idp.key</security:PrivateKey></security:Credential>*


And in JETTY_BASE/modules/ssl.mod we have this configuration:











*[depend]server[xml]etc/jetty-ssl.xml[files]http://git.eclipse.org/c/jetty/org.eclipse.jetty.project.git/plain/jetty-server/src/main/config/etc/keystore|etc/keystore
<http://git.eclipse.org/c/jetty/org.eclipse.jetty.project.git/plain/jetty-server/src/main/config/etc/keystore|etc/keystore>[ini-template]jetty.secure.port=443jetty.keystore=/opt/shibboleth-idp/credentials/idp.p12jetty.keystore.type=PKCS12jetty.keystore.password=mypassword*


For stablishing communication between SP and the new IdP, we have copied
the idp-metadata.xml into SP. From SP we are redirected to IdP but fails
when the certificate is checked. Here the logfiles:

















*16:17:15.173 - DEBUG
[org.opensaml.xml.security.credential.criteria.EvaluableCredentialCriteriaRegistry:74]
- Registry located evaluable criteria class
org.opensaml.xml.security.credential.criteria.EvaluableUsageCredentialCriteria
for criteria class
org.opensaml.xml.security.criteria.UsageCriteria16:17:15.173 - DEBUG
[org.opensaml.xml.security.credential.criteria.EvaluableCredentialCriteriaRegistry:105]
- Registry could not locate evaluable criteria for criteria class
org.opensaml.security.MetadataCriteria16:17:15.173 - DEBUG
[org.opensaml.xml.security.credential.criteria.EvaluableCredentialCriteriaRegistry:74]
- Registry located evaluable criteria class
org.opensaml.xml.security.credential.criteria.EvaluableEntityIDCredentialCriteria
for criteria class
org.opensaml.xml.security.criteria.EntityIDCriteria16:17:15.177 - DEBUG
[org.opensaml.xml.security.credential.criteria.EvaluableCredentialCriteriaRegistry:74]
- Registry located evaluable criteria class
org.opensaml.xml.security.credential.criteria.EvaluableKeyAlgorithmCredentialCriteria
for criteria class
org.opensaml.xml.security.criteria.KeyAlgorithmCriteria16:17:15.178 - DEBUG
[org.opensaml.xml.signature.impl.ExplicitKeySignatureTrustEngine:159] -
Attempting to verify signature using trusted credentials16:17:15.185 -
DEBUG [org.opensaml.xml.signature.impl.ExplicitKeySignatureTrustEngine:172]
- Failed to verify signature using either supplied candidate credential or
directly trusted credentials16:17:15.185 - DEBUG
[org.opensaml.xml.signature.impl.PKIXSignatureTrustEngine:171] - Candidate
credential was either not supplied or did not contain verification
key16:17:15.186 - DEBUG
[org.opensaml.xml.signature.impl.PKIXSignatureTrustEngine:172] - PKIX trust
engine requires supplied key, skipping PKIX trust evaluation16:17:15.186 -
WARN
[org.opensaml.common.binding.security.BaseSAMLSimpleSignatureSecurityPolicyRule:195]
- Simple signature validation (with no request-derived credentials)
failed16:17:15.186 - WARN
[org.opensaml.common.binding.security.BaseSAMLSimpleSignatureSecurityPolicyRule:138]
- Validation of request simple signature failed for context issuer:
https://.../mellon16:17:15.187 - WARN
[edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler:406]
- Message did not meet security
requirementsorg.opensaml.ws.security.SecurityPolicyException: Validation of
request simple signature failed for context issuer    at
org.opensaml.common.binding.security.BaseSAMLSimpleSignatureSecurityPolicyRule.doEvaluate(BaseSAMLSimpleSignatureSecurityPolicyRule.java:139)
~[opensaml-2.6.5.jar:na]    at
org.opensaml.common.binding.security.BaseSAMLSimpleSignatureSecurityPolicyRule.evaluate(BaseSAMLSimpleSignatureSecurityPolicyRule.java:103)
~[opensaml-2.6.5.jar:na]    at
org.opensaml.ws.security.provider.BasicSecurityPolicy.evaluate(BasicSecurityPolicy.java:51)
~[openws-1.5.5.jar:na]    at
org.opensaml.ws.message.decoder.BaseMessageDecoder.processSecurityPolicy(BaseMessageDecoder.java:132)
~[openws-1.5.5.jar:na]    at
org.opensaml.ws.message.decoder.BaseMessageDecoder.decode(BaseMessageDecoder.java:83)
~[openws-1.5.5.jar:na]   *
    .....

Another question about Shibboleth configuration is: How we can load the
SAML metadata from the SP with which we will interact? We tried to
configure it in IDP_HOME/conf/relying-party.xml following this procedure:
https://wiki.shibboleth.net/confluence/display/SHIB2/IdPMetadataProvider#IdPMetadataProvider-HTTPMetadataProvider
<https://wiki.shibboleth.net/confluence/display/SHIB2/IdPMetadataProvider>
but we can not find where we need to register the SP. How should be set
this step?


Thanks in advance,
Esther
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20150609/a1de1374/attachment.html>