Invalid Response message (29) - SOLVED (one of many solutions/problems)

[Eric Wedaa]

ALL;

   Just so this is stored online so the next poor person running into this MIGHT see this particular solution..

  I am using Shibboleth IDP 2.4.0, trying to connect to WebEx.  

  I have a (basically) working set of .xml files.

  After I login to my IDP, and get redirected back to WebEx, I received the oh-so-cryptic error message "Invalid Response message (29)".


  The following is from my /opt/shibboleth-idp/logs/idp-process.log  :
[root at idp OLD]# grep crypt *
idp-process-2015-11-03.log:19:04:36.136 - ERROR [edu.internet2.middleware.shibboleth.idp.profile.saml2.AbstractSAML2ProfileHandler:927] - Could not resolve a key encryption credential for peer entity: http://www.webex.com
idp-process-2015-11-03.log:19:04:36.137 - ERROR [edu.internet2.middleware.shibboleth.idp.profile.saml2.AbstractSAML2ProfileHandler:289] - Unable to construct encrypter
idp-process-2015-11-03.log:org.opensaml.xml.security.SecurityException: Could not resolve key encryption credential


What I did to fix this (solution/solved):

Somehow I must have misconfigured something.  In particular I messed up the AuthnContextClassRef string, was using a default setting for "WebEx SAML Issuer (SP ID)", and may or may not have uploaded the right file for "Import SAML Metadata".

GORY details follow:

I went BACK to the WebEX/SSO configuration screen.

SSO Profile:   I made sure this was set to "SP Initiated"

Target page URL Parameter :  I left this as "TARGET"

WebEx SAML Issuer (SP ID):  I set this to "https://sitename-marist.webex.com"  This was previously set to (following different instructions) to "http://www.webex.com".  This is also the default setting when I first went into that screen.  Please also note that I am using "https"  (encrypted) instead of their default of "http".

Issuer for SAML (IdP ID):  I made sure this was set to "https://MY_IDP_SERVER.marist.edu:8443/idp/shibboleth"  (Yes, I am talking directly to port 8443).

Customer SSO Service Login URL: I set this to "https://MY_IDP_SERVER.marist.edu:8443/idp/profile/SAML2/Redirect/SSO"

NameID Format: I left this as "unspecified".  This may or may not cause other problems later.  I don't know, but I see a lot of other people leaving this as "unspecified".

AuthnContextClassRef: I reset this to "urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport".    Among other things, at some point I had added an extra character into this line.  WebEx does no error checking on this line, so that may have been the problem I had.  (Or not).

Default WebEx Target page URL: I left this as blank 

Customer SSO Error URL:   I left this as blank also

Auto Account Creation: I enabled this.

I clicked the "Update" button.

I then uploaded my metadata file again (/opt/shibboleth-idp/metadata/idp-idp-metadata.xml) again.  WebEx does not save/show the name of the file you uploaded, nor does it show the date it was uploaded, so I have no way of KNOWING that I uploaded the right file.

I clicked the "Update" button.

I clicked the "Export" button.

I then copied that file webex_SP_saml2_metadata.xml back to /opt/shibboleth-idp/metadata/webex_SP_saml2_metadata.xml.  Yes, it was different than the one I had there before.  among other things, the entityID was different and was now set to "https://sitename-marist.webex.com", instead of the old default of www.webex.com.

I restarted Tomcat.

AND.....

Now no more error 29. :-)

Now to move on to error 31, which appears to be me messingup/not having my attributes configured properly/gosh knows what.

A HUGE thanks to David Swartz of Hamilton College in Clinton NY for his help in getting everything setup properly!


>>>>Ericw