XMLTooling.CredentialCriteria [10]: keys didn't match

lorenzo.martino lorenzo.martino at tbsit.com
Tue Nov 24 06:59:52 EST 2015 

I'm tring to configure shibboleth idp v.3.1.3 on windows2008 with tomcat 8.
Testing the idp with testshib, from log i see the error in testshiblog,  
"XMLTooling.CredentialCriteria [10]: keys didn't match ", can you give 
me any help about it.
I'm using a new keystore with server certificate released from CA for 
ssl support of tomcat web server.

L. Martino

2015-11-20 12:53:31 INFO OpenSAML.MetadataProvider.XML : reload thread 
finished
2015-11-20 12:53:31 INFO OpenSAML.MetadataProvider.XML : reload thread 
finished
2015-11-20 12:53:31 INFO Shibboleth.SecurityPolicyProvider.XML : reload 
thread finished
2015-11-20 12:59:48 INFO XMLTooling.StorageService : purged 2 expired 
record(s) from storage
2015-11-20 13:00:50 DEBUG Shibboleth.Listener [10]: dispatching message 
(default/SAML2/POST)
2015-11-20 13:00:50 DEBUG OpenSAML.MessageDecoder.SAML2POST [10]: 
validating input
2015-11-20 13:00:50 DEBUG OpenSAML.MessageDecoder.SAML2POST [10]: 
decoded SAML message:
<?xml version="1.0" encoding="UTF-8"?>
<saml2p:Response 
Destination="https://sp.testshib.org/Shibboleth.sso/SAML2/POST" 
ID="_88af1d5f397d2ab73b8f527ea968f3dc" 
InResponseTo="_7bb87073530c9e5c424c65f8221104cb" 
IssueInstant="2015-11-20T18:00:36.421Z" Version="2.0" 
xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol"><saml2:Issuer 
xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">https://kos-shib-idp.gruppohss.it/idp/shibboleth</saml2:Issuer><ds:Signature 
xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
<ds:SignedInfo>
<ds:CanonicalizationMethod 
Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
<ds:SignatureMethod 
Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha512"/>
<ds:Reference URI="#_88af1d5f397d2ab73b8f527ea968f3dc">
<ds:Transforms>
<ds:Transform 
Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
<ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
</ds:Transforms>
<ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha512"/>
<ds:DigestValue>Xw4jSW/T5rRKF1GeLb/XpcVI7AESR1l46WHMDPOZGVcoel3Pr8UdWYZu9XDshuuy3QpC7EYAGDCu 

/krlLqf6FQ==</ds:DigestValue>
</ds:Reference>
</ds:SignedInfo>
<ds:SignatureValue>
ZxyDJs10kHcLt9z0Y+hjxxANF4jxkTci9qloU9ZeYmTBDgAKpEWj0ajC1LXPKSqqmISeyOzRCy99 

T4XJoXRrTM5HRRbniu2iCdRhZxBnHonsCclFlWQU63m763sw+44cnhaV4iWCrpBKg7GPwftS+Ti9 

cZgo7FQuCJgaPRXJp63uvHU8xa2OZNZo+8hUXj1GD2IU/57cCKAHsQVnPcw0vEy2Vd5BmrJQzqjy 

LMeaxBNu1tkGiPXqR7+Mh1xk4LZYvZaieMtYHtrRMh1AG3atl1u6DHjUFt4dvzmkfsRBSw3RV6oW 

8l/D25m3nsVpSupADRfHmhsVoLwnpoeVhSBErA==
</ds:SignatureValue>
<ds:KeyInfo><ds:X509Data><ds:X509Certificate>MIIDUDCCAjigAwIBAgIVAM10S9y9v7fnjdE3Z43VQhwupUHzMA0GCSqGSIb3DQEBCwUAMCQxIjAg 

BgNVBAMMGWtvcy1zaGliLWlkcC5ncnVwcG9oc3MuaXQwHhcNMTUxMTIwMTYyOTIxWhcNMzUxMTIw 

MTYyOTIxWjAkMSIwIAYDVQQDDBlrb3Mtc2hpYi1pZHAuZ3J1cHBvaHNzLml0MIIBIjANBgkqhkiG 

9w0BAQEFAAOCAQ8AMIIBCgKCAQEAm+CSTto5GCyQvoPf/MBhA+gzq1a4V8IxbCDJkh3AlkLy74L7 

piwfYbd7v7w1OqPKtGtH0y+yXk9ek4g1nFMV6z6vS10zFOpgu/I9Hp58ELGM/u1pMuJCbLs7lLN0 

l2JBp27fP57KEoj/YVEUJvkvBsZdp7afHKBnK2hZvCAsjRe1OiVHb7CWDdMdlFo7GGs1gnwfFdjt 

PX5hxBO5bo9My+ONy7iPqAXt95BPQJIQPO5TyBkl+H2pCgMmbiZwJP36/TRaP3DRkSgmlkOeO+3+ 

t7nltz+WxxkAqt8FwH/u6vheympCRU+EYquI7n8+9T0XwQ3QWMRoqySJiFubAW3ZYQIDAQABo3kw 

dzAdBgNVHQ4EFgQUv9uTWvD1vtvneCk0YIXHQqDHCRkwVgYDVR0RBE8wTYIZa29zLXNoaWItaWRw 

LmdydXBwb2hzcy5pdIYwaHR0cHM6Ly9rb3Mtc2hpYi1pZHAuZ3J1cHBvaHNzLml0L2lkcC9zaGli 

Ym9sZXRoMA0GCSqGSIb3DQEBCwUAA4IBAQCIWzfZ/rZH3AoM2OoOzXY5dayyqVTbM5OT8n4tpx36 

K26y6eA6WUIe0UFMedJyxIUcSSG6UMX0S6VRu4KkIoT/EO6H9ODB9cS6sq7vCvnYz7VQ7buGZYP3 

wU2VjSld5CNIv7PwB9nAh9ZcIx8yOLsjqd7Mam20LC1d5Q9xahxM+RLigOS80L3U1udFjyvsIxP7 

GZIOlgi85MuWgPX2126gen9ARGN47YQ9i/CsVKefzw3GOw15206qab4NeK8Gm0aFYJC4pV2MlFpc 

PI3GGzqXoB737T6r1HigDZO6TuTqQwlIKzWyg5F1wfuCHWmSNzrGW60AT86XJHHGat8wzzX+</ds:X509Certificate></ds:X509Data></ds:KeyInfo></ds:Signature><saml2p:Status><saml2p:StatusCode 
Value="urn:oasis:names:tc:SAML:2.0:status:Success"/></saml2p:Status><saml2:EncryptedAssertion 
xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"><xenc:EncryptedData 
Id="_0e8566ca5ca3d1f1725209aa57d53cb7" 
Type="http://www.w3.org/2001/04/xmlenc#Element" 
xmlns:xenc="http://www.w3.org/2001/04/xmlenc#"><xenc:EncryptionMethod 
Algorithm="http://www.w3.org/2009/xmlenc11#aes128-gcm" 
xmlns:xenc="http://www.w3.org/2001/04/xmlenc#"/><ds:KeyInfo 
xmlns:ds="http://www.w3.org/2000/09/xmldsig#"><xenc:EncryptedKey 
Id="_a104b716bfc7cd048a34fcadaa6ab2ac" 
Recipient="https://sp.testshib.org/shibboleth-sp" 
xmlns:xenc="http://www.w3.org/2001/04/xmlenc#"><xenc:EncryptionMethod 
Algorithm="http://www.w3.org/2009/xmlenc11#rsa-oaep" 
xmlns:xenc="http://www.w3.org/2001/04/xmlenc#"><ds:DigestMethod 
Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" 
xmlns:ds="http://www.w3.org/2000/09/xmldsig#"/><xenc11:MGF 
Algorithm="http://www.w3.org/2009/xmlenc11#mgf1sha1" 
xmlns:xenc11="http://www.w3.org/2009/xmlenc11#"/></xenc:EncryptionMethod><ds:KeyInfo><ds:X509Data><ds:X509Certificate>MIIEPjCCAyagAwIBAgIBADANBgkqhkiG9w0BAQUFADB3MQswCQYDVQQGEwJVUzEVMBMGA1UECBMM 

UGVubnN5bHZhbmlhMRMwEQYDVQQHEwpQaXR0c2J1cmdoMSIwIAYDVQQKExlUZXN0U2hpYiBTZXJ2 

aWNlIFByb3ZpZGVyMRgwFgYDVQQDEw9zcC50ZXN0c2hpYi5vcmcwHhcNMDYwODMwMjEyNDM5WhcN 

MTYwODI3MjEyNDM5WjB3MQswCQYDVQQGEwJVUzEVMBMGA1UECBMMUGVubnN5bHZhbmlhMRMwEQYD 

VQQHEwpQaXR0c2J1cmdoMSIwIAYDVQQKExlUZXN0U2hpYiBTZXJ2aWNlIFByb3ZpZGVyMRgwFgYD 

VQQDEw9zcC50ZXN0c2hpYi5vcmcwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDJyR6Z 

P6MXkQ9z6RRziT0AuCabDd3x1m7nLO9ZRPbr0v1LsU+nnC363jO8nGEqsqkgiZ/bSsO5lvjEt4eh 

ff57ERio2Qk9cYw8XCgmYccVXKH9M+QVO1MQwErNobWbAjiVkuhWcwLWQwTDBowfKXI87SA7KR7s 

FUymNx5z1aoRvk3GM++tiPY6u4shy8c7vpWbVfisfTfvef/y+galxjPUQYHmegu7vCbjYP3On0V7 

/Ivzr+r2aPhp8egxt00QXpilNai12LBYV3Nv/lMsUzBeB7+CdXRVjZOHGuQ8mGqEbsj8MBXvcxIK 

bcpeK5ZiJCVXPfarzuriM1G5y5QkKW+LAgMBAAGjgdQwgdEwHQYDVR0OBBYEFKB6wPDxwYrYStNj 

U5P4b4AjBVQVMIGhBgNVHSMEgZkwgZaAFKB6wPDxwYrYStNjU5P4b4AjBVQVoXukeTB3MQswCQYD 

VQQGEwJVUzEVMBMGA1UECBMMUGVubnN5bHZhbmlhMRMwEQYDVQQHEwpQaXR0c2J1cmdoMSIwIAYD 

VQQKExlUZXN0U2hpYiBTZXJ2aWNlIFByb3ZpZGVyMRgwFgYDVQQDEw9zcC50ZXN0c2hpYi5vcmeC 

AQAwDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQUFAAOCAQEAc06Kgt7ZP6g2TIZgMbFxg6vKwvDL 

0+2dzF11Onpl5sbtkPaNIcj24lQ4vajCrrGKdzHXo9m54BzrdRJ7xDYtw0dbu37l1IZVmiZr12eE 

Iay/5YMU+aWP1z70h867ZQ7/7Y4HW345rdiS6EW663oH732wSYNt9kr7/0Uer3KD9CuPuOidBaco 

spDaFyfsaJruE99Kd6Eu/w5KLAGG+m0iqENCziDGzVA47TngKz2vPVA+aokoOyoz3b53qeti77ij 

atSEoKjxheBWpO+eoJeGq/e49Um3M2ogIX/JAlMaInh+vYSYngQB2sx9LGkR9KHaMKNIGCDehk93 

Xla4pWJx1w==</ds:X509Certificate></ds:X509Data></ds:KeyInfo><xenc:CipherData 
xmlns:xenc="http://www.w3.org/2001/04/xmlenc#"><xenc:CipherValue>Kndx/35h+3q7pKNdT20KzUyx2WlO8JVxTlCQg8tViNBozae6Q41uf84CINsrJf3WEz5wGEcaXOQQ 

9V9BLROVQj7UxU6KR7dpvjjKF28O1nb0n4pwv6E0b1tGmr8ILaMh5L6wgrD/os372OeQNT0doEVK 

6PH4WcRf4kM9QIhfHnHVUGa05zLVQKNk42mmzjuuMicqgJe5BAhUupYpegodKIb5XKBD41LIK8/f 

bIUDjdqccJO4sDLDATJmWUYS/mmJLq6IGJgFbDd+RJ+iE0PnRp5F22bHBCoDhvuBprmCkv95Okqm 

mAm+kRNyb5AGApFlkGSAFgxdcNReaBENgmA1OQ==</xenc:CipherValue></xenc:CipherData></xenc:EncryptedKey></ds:KeyInfo><xenc:CipherData 
xmlns:xenc="http://www.w3.org/2001/04/xmlenc#"><xenc:CipherValue>NlHkAhE0tyZnaQodif9wpf704SdfFfv3JFbNhgL3x1Byu7ebRe0cYglRzX6IfjfJreVi18dVN0P4 

RlQzueFLDNC1ildeNZZskVUTRjJVTT9tCb4Krd3gx/AudM03Eh+urzYp/ip4Xc/Qik+NrxWP6dQ1 

UjyIDRGxj3Fm8eYg99BIxFMtnKJ5XjDa8SoogtfhTprJlj1O9kKAIi5ILzsJnqSwHaKec7ZpB+yi 

Y/sptcPrPr+cM+g/lI8Ygo2adExzLF+kNZFex0seHO4RSddNUYIN508F/Gc9BeM8zhqKL20sqECo 

pXbUP98uUnCRnNgPlphs2/41e6v6Cn5c3Q3Xo+nGSgZGQr72aK/yO/bP/W+4o7RkhLol2a5/Mpd+ 

hTMAA9QeCSAF31GONF+3o2vLDr9qnQ/ufDGHhjwA41HbNZmC+M33zkbmlAYIg3UEgnN8sOoVQGK2 

llzDkk6hWkvMEV2w+KKuETCdbNt370UDPBI6xifu2c7VUTR6ULq1t2aGGaQNWcznb16rTjTh4m1b 

swnShDe4h+tMZrQHQ86JRoHu1n5WpomG3CpJSfZg94+0XSPxorhiZHHJdPdNfnaHB5Sr5JKI9NLQ 

ZL03eV6kgW3qIplAhWXRZ0SOFmrWV4kJk4McSoHBqCstWcffuvQC0g8Evzl91tt9m4pxKk60Q1/P 

pF+rrDhy6ufdI+Y3bVIFyB3dZWDIiaLfOiCCm4GUz3CIb6z/KTM3tKkiLEFS698tW/tcTG4Itq5V 

8HgUAcCdIwFFmt7TlB1ZgMxsWi08Cj+3YZV5f+DagHsVB+vQTQ3AHTAsDq0Oi0Ye3kUID59du9w5 

5pzYWBPQwtLooSxeBqRqh+QwP0MJeV2IIFi+d2dpl4mkqHok2ong+XPKexm7SI6k8c7fFWZgqHGV 

emvP2dWFFamKzuvmPicTj9R0pY5/Mp1qOZ0mjVF1nky6+Sai6VyqeTthpF+fNSS2Ybq75VwDWVo2 

ZCm3sr3XNqDShvpIdW0EthAG7Jyoeq5/oUf9sIiOYLG/QpGp/7/3CGKGRYgnMAz6uX6t2xhXFfFy 

HbHYYT1IUmiTlirnTri1qPpPBmYKlxC1cGBkWDegb7E8U6wAAXnaLVcSUBTARwnHX1ftpWrypwnx 

qNffSDz9ma9vdujedm1WZxo4SU5RUJyg0kyGRsCQUvCC2Olr41I08l70dBnI5mOPyuhm67YFPY9w 

iRQKJGJACFQH6Px3gSWoiR61H2/RdFqlBFY8hKFMA50+Gblsnj8pAa9k4C7grStrtG6x8osyKLuK 

aKc4jZgvv/rwqDh3WKNA+Wor5n61SfsAYFJtZIAkttNLSBqLXpJCLLGahmgVw0S8DSefgMvhHdYB 

k3ppf+WWv1shBSnF0TDEOdBW+0Aps882GKLMWXYRi+VZpGJAaviC8wzzonyS8yk5LXjma0kX3EIC 

zgvCTgweGIslhbat+EeMF5I4DFrDUJTeWSmlZvGCcs/Pl35D9GOZuqa1jv+GFeTR+UdgVQANXBqw 

r2/IiAgVUvZ4Hyj6/krX3QxzsWCGWwFUMAqlg5v4AA+r6I2s348gQBLU87v8i/4IcKzic9s1tvD5 

3F9Q4mA2XWfuSdfSOpENmOIdQ0a9kkHHTuNpHgGAPpjH1AfAUQmvHZExrGjLqESOHooDfcJkE8oI 

XOWIRxBmddvZ51Q22+HUUuoV+CYCGjXIpp9o4uy37jf+aELtZ+ESSBG6G93p/ttEcEjna29JrrpL 

GTRRaaUh38TSJK9qjE8Lsz+WzpFkrzB1vTW4LpWr5Ev3732m80ei00PHdgFjhuGt9HBAae1/yjht 

jnI1wJ2sklsdtymuG7pzCGqXdEt1R17s/tFsU7IX9pi4t6YRArv29n/DF1m+rKhWoCokjWD4wCNl 

utO3+1JaqfaZxsobW+Hn4X2Rw3+JASotV1cl7H1fASmu5zDAZBejm5WoHfRIoknEvw/EIX/ByhtQ 

MULswL/7pT9too86VaXB6fJpu476fVEmS49n3Y6GiBrkxvHmshURj7ydzLQ+OXSPd90HO9UvuIs4 

GE7no9UcUpHQ80mH78VgWwmtRXR6wlOSPj7cW2/fc84fpgvVWf/d9GyAecgCseesSuzS6IjpzsgF 

eZ/w3A7BAXUe7Yjma282hEszkamnb6ArSIxpzt2qi5qZsqe13ozcmlVd282AVEfw</xenc:CipherValue></xenc:CipherData></xenc:EncryptedData></saml2:EncryptedAssertion></saml2p:Response> 

2015-11-20 13:00:50 DEBUG OpenSAML.MessageDecoder.SAML2 [10]: extracting 
issuer from SAML 2.0 protocol message
2015-11-20 13:00:50 DEBUG OpenSAML.MessageDecoder.SAML2 [10]: message 
from (https://kos-shib-idp.gruppohss.it/idp/shibboleth)
2015-11-20 13:00:50 DEBUG OpenSAML.MessageDecoder.SAML2 [10]: searching 
metadata for message issuer...
2015-11-20 13:00:50 DEBUG OpenSAML.SecurityPolicyRule.MessageFlow [10]: 
evaluating message flow policy (replay checking on, expiration 60)
2015-11-20 13:00:50 DEBUG XMLTooling.StorageService [10]: inserted 
record (_88af1d5f397d2ab73b8f527ea968f3dc) in context (MessageFlow) with 
expiration (1448042676)
2015-11-20 13:00:50 DEBUG OpenSAML.SecurityPolicyRule.XMLSigning [10]: 
validating signature profile
2015-11-20 13:00:50 DEBUG XMLTooling.KeyInfoResolver.Inline [10]: 
resolving ds:X509Certificate
2015-11-20 13:00:50 DEBUG XMLTooling.KeyInfoResolver.Inline [10]: 
resolved 1 certificate(s)
2015-11-20 13:00:50 DEBUG XMLTooling.KeyInfoResolver.Inline [10]: 
resolved 0 CRL(s)
2015-11-20 13:00:50 DEBUG XMLTooling.KeyInfoResolver.Inline [10]: 
resolving ds:X509Certificate
2015-11-20 13:00:50 DEBUG XMLTooling.KeyInfoResolver.Inline [10]: 
resolved 1 certificate(s)
2015-11-20 13:00:50 DEBUG XMLTooling.KeyInfoResolver.Inline [10]: 
resolved 0 CRL(s)
2015-11-20 13:00:50 DEBUG XMLTooling.KeyInfoResolver.Inline [10]: 
resolving ds:X509Certificate
2015-11-20 13:00:50 DEBUG XMLTooling.KeyInfoResolver.Inline [10]: 
resolved 1 certificate(s)
2015-11-20 13:00:50 DEBUG XMLTooling.KeyInfoResolver.Inline [10]: 
resolved 0 CRL(s)
2015-11-20 13:00:50 DEBUG XMLTooling.CredentialCriteria [10]: keys 
didn't match
2015-11-20 13:00:50 DEBUG XMLTooling.CredentialCriteria [10]: keys 
didn't match
2015-11-20 13:00:50 DEBUG XMLTooling.TrustEngine.ExplicitKey [10]: 
unable to validate signature, no credentials available from peer
2015-11-20 13:00:50 DEBUG XMLTooling.TrustEngine.PKIX [10]: validating 
signature using certificate from within the signature
2015-11-20 13:00:50 DEBUG XMLTooling.TrustEngine.PKIX [10]: signature 
verified with key inside signature, attempting certificate validation...
2015-11-20 13:00:50 DEBUG XMLTooling.TrustEngine.PKIX [10]: checking 
that the certificate name is acceptable
2015-11-20 13:00:50 DEBUG XMLTooling.TrustEngine.PKIX [10]: adding to 
list of trusted names (https://kos-shib-idp.gruppohss.it/idp/shibboleth)
2015-11-20 13:00:50 DEBUG XMLTooling.TrustEngine.PKIX [10]: certificate 
subject: CN=kos-shib-idp.gruppohss.it
2015-11-20 13:00:50 DEBUG XMLTooling.TrustEngine.PKIX [10]: unable to 
match DN, trying TLS subjectAltName match
2015-11-20 13:00:50 DEBUG XMLTooling.TrustEngine.PKIX [10]: matched 
DNS/URI subjectAltName to a key name 
(https://kos-shib-idp.gruppohss.it/idp/shibboleth)
2015-11-20 13:00:50 DEBUG XMLTooling.TrustEngine.PKIX [10]: performing 
certificate path validation...
2015-11-20 13:00:50 DEBUG XMLTooling.TrustEngine.PKIX [10]: failed to 
validate certificate chain using supplied PKIX information
2015-11-20 13:00:50 ERROR OpenSAML.SecurityPolicyRule.XMLSigning [10]: 
unable to verify message signature with supplied trust engine
2015-11-20 13:01:35 DEBUG Shibboleth.Listener [7]: dispatching message 
(default/TestShib::run::SAML2SI)
2015-11-20 13:01:35 DEBUG OpenSAML.MessageEncoder.SAML2Redirect [7]: 
validating input
2015-11-20 13:01:35 DEBUG OpenSAML.MessageEncoder.SAML2Redirect [7]: 
marshalling, deflating, base64-encoding the message
2015-11-20 13:01:35 DEBUG OpenSAML.MessageEncoder.SAML2Redirect [7]: 
marshalled message:
<samlp:AuthnRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" 
AssertionConsumerServiceURL="https://sp.testshib.org/Shibboleth.sso/SAML2/POST" 
Destination="https://devextidp.ornl.gov/idp/SSO.saml2" 
ID="_f2f704b6d193408a74ee14b43d205cab" 
IssueInstant="2015-11-20T18:01:35Z" 
ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" 
Version="2.0"><saml:Issuer 
xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">https://sp.testshib.org/shibboleth-sp</saml:Issuer><samlp:NameIDPolicy 
AllowCreate="1"/></samlp:AuthnRequest>
2015-11-20 13:01:35 DEBUG OpenSAML.MessageEncoder.SAML2Redirect [7]: 
message encoded, sending redirect to client
2015-11-20 13:02:01 DEBUG Shibboleth.Listener [4]: dispatching message 
(default/TestShib::run::SAML2SI)
2015-11-20 13:02:01 DEBUG OpenSAML.MessageEncoder.SAML2Redirect [4]: 
validating input
2015-11-20 13:02:01 DEBUG OpenSAML.MessageEncoder.SAML2Redirect [4]: 
marshalling, deflating, base64-encoding the message
2015-11-20 13:02:01 DEBUG OpenSAML.MessageEncoder.SAML2Redirect [4]: 
marshalled message:
<samlp:AuthnRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" 
AssertionConsumerServiceURL="https://sp.testshib.org/Shibboleth.sso/SAML2/POST" 
Destination="https://devintidp.ornl.gov/idp/SSO.saml2" 
ID="_91ce6930746557355122c0f550cfaa9c" 
IssueInstant="2015-11-20T18:02:01Z" 
ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" 
Version="2.0"><saml:Issuer 
xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">https://sp.testshib.org/shibboleth-sp</saml:Issuer><samlp:NameIDPolicy 
AllowCreate="1"/></samlp:AuthnRequest>
2015-11-20 13:02:01 DEBUG OpenSAML.MessageEncoder.SAML2Redirect [4]: 
message encoded, sending redirect to client
2015-11-20 13:02:29 DEBUG Shibboleth.Listener [8]: dispatching message 
(default/TestShib::run::SAML2SI)
2015-11-20 13:02:29 DEBUG OpenSAML.MessageEncoder.SAML2Redirect [8]: 
validating input
2015-11-20 13:02:29 DEBUG OpenSAML.MessageEncoder.SAML2Redirect [8]: 
marshalling, deflating, base64-encoding the message
2015-11-20 13:02:29 DEBUG OpenSAML.MessageEncoder.SAML2Redirect [8]: 
marshalled message:
<samlp:AuthnRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" 
AssertionConsumerServiceURL="https://sp.testshib.org/Shibboleth.sso/SAML2/POST" 
Destination="https://devextidp.ornl.gov/idp/SSO.saml2" 
ID="_d4ffe12ee808fb9826c14d3f35e96588" 
IssueInstant="2015-11-20T18:02:29Z" 
ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" 
Version="2.0"><saml:Issuer 
xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">https://sp.testshib.org/shibboleth-sp</saml:Issuer><samlp:NameIDPolicy 
AllowCreate="1"/></samlp:AuthnRequest>
2015-11-20 13:02:29 DEBUG OpenSAML.MessageEncoder.SAML2Redirect [8]: 
message encoded, sending redirect to client
2015-11-20 13:02:55 DEBUG Shibboleth.Listener [11]: dispatching message 
(default/TestShib::run::SAML2SI)
2015-11-20 13:02:55 DEBUG OpenSAML.MessageEncoder.SAML2Redirect [11]: 
validating input
2015-11-20 13:02:55 DEBUG OpenSAML.MessageEncoder.SAML2Redirect [11]: 
marshalling, deflating, base64-encoding the message
2015-11-20 13:02:55 DEBUG OpenSAML.MessageEncoder.SAML2Redirect [11]: 
marshalled message:
<samlp:AuthnRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" 
AssertionConsumerServiceURL="https://sp.testshib.org/Shibboleth.sso/SAML2/POST" 
Destination="https://devintidp.ornl.gov/idp/SSO.saml2" 
ID="_58203675b87e712aa90a28daad0a431a" 
IssueInstant="2015-11-20T18:02:55Z" 
ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" 
Version="2.0"><saml:Issuer 
xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">https://sp.testshib.org/shibboleth-sp</saml:Issuer><samlp:NameIDPolicy 
AllowCreate="1"/></samlp:AuthnRequest>
2015-11-20 13:02:55 DEBUG OpenSAML.MessageEncoder.SAML2Redirect [11]: 
message encoded, sending redirect to client
2015-11-20 13:03:21 DEBUG Shibboleth.Listener [5]: dispatching message 
(default/TestShib::run::SAML2SI)
2015-11-20 13:03:21 WARN Shibboleth.SessionInitiator.SAML2 [5]: unable 
to locate metadata for provider (kos-shib-idp.gruppohss.it)

More information about the users mailing list