TestShib.org - Testing my SP - Unable to encrypt assertion

[Dip Sarkar]

Hi Kevin,
     The metadata file I uploaded has unique EntityId.
it also has correct X.509 certificate. 

I am attaching my Metadata XML, please see if anything is wrong.

I see this error in the IdPError log:
14:41:26.437 - ERROR [edu.internet2.middleware.shibboleth.idp.profile.saml2.AbstractSAML2ProfileHandler:927] - Could not resolve a key encryption credential for peer entity: dipsilonsolutions.dyndns-office.com/Demo3
14:41:26.438 - ERROR [edu.internet2.middleware.shibboleth.idp.profile.saml2.AbstractSAML2ProfileHandler:289] - Unable to construct encrypter
org.opensaml.xml.security.SecurityException: Could not resolve key encryption credential
	at edu.internet2.middleware.shibboleth.idp.profile.saml2.AbstractSAML2ProfileHandler.getEncrypter(AbstractSAML2ProfileHandler.java:928) ~[shibboleth-identityprovider-2.4.0.jar:na]

BR,
Dip

___________________________________
From: users-bounces at shibboleth.net <users-bounces at shibboleth.net> on behalf of Kevin Foote <kpfoote at uoregon.edu>
Sent: Thursday, March 12, 2015 11:00 PM
To: Shib Users
Subject: Re: TestShib.org - Testing my SP - Unable to encrypt assertion

> On Mar 12, 2015, at 10:09 AM, Kevin Foote <kpfoote at uoregon.edu> wrote:
>
>
>> On Mar 12, 2015, at 10:06 AM, Dip Sarkar <dip.sarkar at agiloft.com> wrote:
>>
>> Hi,
>>    I have implemented a SAML v2 Service Provider, I am testing it out  with IdP @TestShib.org.
>> I get the following SAML Assertion after I login with suggested user/password at TestShib.org , Since the NameId is not sent in the assertion, I cannot verify my SAML v2 implementation completely.
>>
>> ..... <saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Responder"/><saml2p:StatusMessage>Unable to encrypt assertion</saml2p:StatusMessage></saml2p:Status></saml2p:Response>
>>
>> Please suggest if I missed any config / anything needs to be configured at TestShib.org.
>
> Nope. And I’ll take a look see :-)

So I believe you need to use and entityId that is specific to your host.
IE. your MD file needs to be unique


--------
thanks
 kevin.foote
--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
-------------- next part --------------
A non-text attachment was scrubbed...
Name: DS3-SP-Metadata.zip
Type: application/x-zip-compressed
Size: 1728 bytes
Desc: DS3-SP-Metadata.zip
Url : http://shibboleth.net/pipermail/users/attachments/20150312/c694e4eb/attachment.bin