TestShib.org - Testing my SP - Unable to encrypt assertion

[Dip Sarkar]

Hi,
   Found the issue , the attribute  use="signing" in KeyDescriptor  in MD was causing this.

Now I get an encrypted SAML response. 

I will change the EntityID to a valid URI as you suggested.

Actually I have 2 instances of SP running on two Tomcat servers , one with Demo3 and another Demo4.

Is there a way , in which I can tell IDP ( testshib) NOT to encrypt the SAML Response?

Thanks for all your help
BR,
Dip

________________________________________
From: users-bounces at shibboleth.net <users-bounces at shibboleth.net> on behalf of Brent Putman <putmanb at georgetown.edu>
Sent: Friday, March 13, 2015 1:29 AM
To: users at shibboleth.net
Subject: Re: TestShib.org - Testing my SP - Unable to encrypt assertion

On 3/12/15 3:35 PM, Dip Sarkar wrote:

>
> I see this error in the IdPError log:
> 14:41:26.437 - ERROR [edu.internet2.middleware.shibboleth.idp.profile.saml2.AbstractSAML2ProfileHandler:927] - Could not resolve a key encryption credential for peer entity: dipsilonsolutions.dyndns-office.com/Demo3

Two things:

1) Syntactically that's not really a valid entityID.  Per SAML spec it
needs to be an absolute URI, with a scheme etc.   The IdP won't care,
treats it as a string, but just pointing it out.

2) In the attached metadata you have an entity with
entityID="dipsilonsolutions.dyndns-office.com/Demo4" .  That's not the
same as above.  /Demo3 vs /Demo4.  So that's the source of the problem,
if that's really the metadata you loaded, since the SP is acting as the
../Demo3 one.

--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net