Help getting started with idp v3, getting error " Validation failure: Failed to resolve both a data and a key encryption credential"

[Marc Boorshtein]

All,

I'm getting the idp up and running for some testing and am running into an
issue.  The idp is running on CentOS 6.6 and tomcat 7 with openjdk and an
apache 2.2 instance in front of it.  My steps to deploy were:

1.  Download the idp
2.  Run ./install.sh
3.  copy idp.war to tomcat7/webapps
4.  setn JAVA_OPTS="-Didp.home=..."
5.  update ldap.properties
6.  Created a metadata file from the SP (below)

<md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
ID="fefb24095e308700eef9645f733ddb0f47649a80b" entityID="
http://sp.autoidm.com:9090/auth/SAML2Auth"><md:SPSSODescriptor
AuthnRequestsSigned="false" WantAssertionsSigned="false"
protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol"><md:SingleLogoutService
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="
http://sp.autoidm.com:9090/auth/SAML2Auth"/><md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</md:NameIDFormat><md:AssertionConsumerService
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="
http://sp.autoidm.com:9090/auth/SAML2Auth" index="0"
isDefault="true"/><md:AssertionConsumerService
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="
http://sp.autoidm.com:9090/auth/SAML2Auth" index="1"
isDefault="false"/></md:SPSSODescriptor></md:EntityDescriptor>

7.  Configured the SP with the idp's metadata
8.  Restart tomcat
9.  Start an SSO request with the following authnrequest:

<?xml version="1.0" encoding="UTF-8"?>

<saml2p:AuthnRequest

    AssertionConsumerServiceURL="http://sp.autoidm.com:9090/auth/SAML2Auth"

    Destination="http://shib2x.tremolo.lan/idp/profile/SAML2/Redirect/SSO"

    ForceAuthn="false" ID="fd017028a1763d5962be00c5effe7b5a0a0a87260"

    IsPassive="false" IssueInstant="2015-03-10T12:54:57.591Z"

    ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"

    Version="2.0" xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol">

    <saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">
http://sp.autoidm.com:9090/auth/SAML2Auth</saml2:Issuer>

    <saml2p:RequestedAuthnContext Comparison="exact">

        <saml2:AuthnContextClassRef
xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml2:AuthnContextClassRef>

    </saml2p:RequestedAuthnContext>

</saml2p:AuthnRequest>


Instead of being prompted to login I get the following error:

WARN [org.opensaml.xmlsec.impl.BasicEncryptionParametersResolver:221] -
Validation failure: Failed to resolve both a data and a key encryption
credential

I'm guessing this is because the idp expects the authnrequest to be signed
and/or encrypted?  if so how do I disable that?

Any help would be greatly appreciated.

Thanks

Marc
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20150310/d9e04371/attachment-0001.html