Signature validation failure = incorrect certificate?

[IAM David Bantz]

>
> When I attempt to log in to a new vendor SP, my IdP is unable to verify
> the signature on the request, with the following log entry
>

I am interpreting this to mean either the vendor provided me a different
certificate than used to sign the request, or that I botched the process of
converting the certificate provided into the form needed in metadata.  Have
I missed other possible sources of failure that I need to explore?

Thanks,

David Bantz



>
> 14:11:50.760 - WARN
> [org.opensaml.common.binding.security.BaseSAMLSimpleSignatureSecurityPolicyRule:138]
> - Validation of request simple signature failed for context issuer:
> https://admin.dc4.pageuppeople.com/
>
> 14:11:50.761 - WARN
> [edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler:406]
> - Message did not meet security requirements
>
> org.opensaml.ws.security.SecurityPolicyException: Validation of request
> simple signature failed for context issuer
>
>
> Here is the SAML request from Firefox SAMLtracer plugin:
>
>
> <samlp:AuthnRequest ID="_6a479914-ecb4-4f47-9bb3-95c5f404b870"
                    Version="2.0"
                    IssueInstant="2015-11-19T23:21:43.013Z"

Destination="https://idp.alaska.edu/idp/profile/SAML2/Redirect/SSO"
                    ForceAuthn="false"
                    IsPassive="false"

ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"

AssertionConsumerServiceURL="https://admin.dc4.pageuppeople.com//gateway/SAML.aspx?binding=urn%3aoasis%3anames%3atc%3aSAML%3a2.0%3abindings%3aHTTP-POST"
                    xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
                    >
    <saml:Issuer
xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">https://admin.dc4.pageuppeople.com/</saml:Issuer>
    <samlp:NameIDPolicy AllowCreate="true" />
</samlp:AuthnRequest>


The "parameters" view of the request does include a signature:

*GET
**SAMLRequest*:
jZJNb9swDIb/iiFgR1txrCyzEGfIGgwL0K1GnO3QSyHLTCpMljRR7se/n+y0W3YpdiElgtT7kNQKRa8d3wzh3uzh1wAYkt22InfvBVuWZc5SkC1L2ZEt07Jti7RcyMWRzVj7YTkjyQ/wqKypyDyLtx3iADuDQZgQQ7N8keZ5mpeHecHnOWdFNsuLW5Jso4oyIkyV9yE45JSqzmVCC/wpMuiG8Uqdt0elgTabr9dzuodOeZCBNs0NST5bL2HCrshRaIRRvhaI6gH+RGpvg5VWf1KmU+ZUkcEbbgUq5Eb0gDxIPj7OIz5vz0nIvxwOdVrfNAeSbBDBj5xX1uDQg2/APygJ3/fXf8lF1yuTdZJlTpxgcA6s05BJ21N6EgEexfPUQibQPX18kakiyrtCTDDRTzjRBxnNmBxdhIr2FSseL8Ceem2QT8t7uyv3MgKyXo3ZfNqRv6h/u1y8DoCs/6PdFb3QOAs6/i0+utvWViv5nGy0to9XHuJYKhL8EJdE1+eyf3/h+jc=*RelayState*:
landingPage=recruiter&instID=751*SigAlg*:
http://www.w3.org/2000/09/xmldsig#rsa-sha1*Signature*:
lU6+Drh8QgSOJGzdJUdalmsaS2bi65L1QUZH8zXgXQAvlxC43LjeGZYFPgOyOjmz7riDsoGNT75yvaScolDTRMKXblH4sOmHLHrK5pEe3CDRZIq9AK/BDEcrExeqEm5hoV0O+WC6X1FBhl4okx6NTC1GBIlpteYWlY5FaeKm4Mk7O3BrS1DwomJyZy5gshch/9uJ6BFpCkpFCu7sls8ASXGaKSoK964A9Uwecs0NuCOArhm7sXE0gHyTkTIEzWqWgNFTLoV513kes/UueTZcXMOAaxPoqzJsTEIjsfIcchsgkvuAqqM7tOi8/n83XAVeRgXf6N4QtQOYZhiBYJaj2A==
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20151124/f40aa972/attachment.html>