Issue with a ServiceProvider authenticating against testshib.org IdP

[Alessandro Molina]

Il 05/10/15 19:43, Kevin Foote ha scritto:
>> On Oct 5, 2015, at 1:12 PM, Krug, Jeff <Jeff.Krug at gtri.gatech.edu> wrote:
>>
>> ​The metadata posted has a single cert marked as a signing cert, so you do not have an encryption cert, so the error message looks correct.  Either update your metadata to include an encryption cert or do something else so that testshib does not try to encrypt assertions sent to you (assuming it has that level of flexibility).
>
> Thanks Jeff,
>
> More to Jeff’s point .. just remove the  <ns0:KeyDescriptor use="signing”> tags around your cert and re-upload your metadata.
> Please be sure to use the same file name though..
Uhm, thanks, looks like removing use="signing" made it work,
I'm pretty sure I tried that previously, but well now it works.

My final, working, ServiceProvider.xml is:

<?xml version='1.0' encoding='UTF-8'?>
<ns0:EntityDescriptor xmlns:ns0="urn:oasis:names:tc:SAML:2.0:metadata" 
xmlns:xs="http://www.w3.org/2001/XMLSchema"
xmlns:ns1="urn:oasis:names:tc:SAML:metadata:attribute"
xmlns:ns2="urn:oasis:names:tc:SAML:2.0:assertion" 
xmlns:ns4="http://www.w3.org/2000/09/xmldsig#"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
                       entityID="https://asdrubale.co.uk/">
     <ns0:Extensions 
xmlns:alg="urn:oasis:names:tc:SAML:metadata:algsupport">
         <ns1:EntityAttributes>
             <ns2:Attribute Name="http://macedir.org/entity-category"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
                 <ns2:AttributeValue 
xsi:type="xs:string">http://www.geant.net/uri/dataprotection-code-of-conduct/v1
                 </ns2:AttributeValue>
             </ns2:Attribute>
         </ns1:EntityAttributes>
     </ns0:Extensions>
     <ns0:SPSSODescriptor AuthnRequestsSigned="false" 
WantAssertionsSigned="true"
protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
         <ns0:KeyDescriptor>
             <ns4:KeyInfo>
                 <ns4:X509Data>
<ns4:X509Certificate>MIIC7zCCAdegAwIBAgIJAKNUFVpcL0KLMA0GCSqGSIb3DQEBBQUAMBIxEDAOBgNV
BAMTB0xQdWxzYXIwHhcNMTUxMDA1MTYwNTAyWhcNMjUxMDAyMTYwNTAyWjASMRAw
DgYDVQQDEwdMUHVsc2FyMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA
04Dvyk0OAmkcjFIzptAJyluGcfP8WsmdE01XOvIV0bi40Cc1c3SCfdXM+AU7kiz6
Ew37m9kXz1FbIw9n9Zsv3ImJ7lqQ1/ZKUkzB/Aj49p85XsoqMwtRq8Zwun9sLAME
+sjWh4+OyQH2Dr/Na7WnafuuYeIl72rFAoUg2IDEodZ5b204suKp1qi0GQwYm2Jp
Ahh0f46RhXawcYVmTMPUS6XQjJ+WH95sDxxxV6Yjfw7d3uZNQ+cNAec7hFxSSAka
nShkimm6KfC5x04jgjz1YA4iNXPoj2Pi2E0l3EBl16qBmhjXoppagriHfN+xIxcD
hEggCSaYLui2Qm/8maeqQwIDAQABo0gwRjAlBgNVHREEHjAcggdMUHVsc2FyhhFo
dHRwczovL2xvY2FsaG9zdDAdBgNVHQ4EFgQUQbbmEqIJlFT8GRdSPE56N+dGZi8w
DQYJKoZIhvcNAQEFBQADggEBAC8jKuZWkHx/AhM1GL2vHq/h9SxHoHFcyYDipVyC
Ql5VB5PjTaLdQ9RZCtJhlJa75DeVfW6hncDY5Q2phb7MwH2GfWm/bZwmPyfwsEeI
uzOcfyWU24582ITtWBNGkaxkE3uI5cDRvmKfO6fTrAdvw+emtVzYOUcAxzqz0PAQ
B5f2jLbg2sTLB6d4KawGPoq3JtVXPgagIANZ5IsR/dem3FIsZFj8nsztibFFTH/O
ljUAfZledVW5KIfApmHMc4qLvAuSSOSmax6ksBjPE4LVZx/9iftHQOMsucW1O4Ob
ykh4ttyYdRoNP1es5xuzTF3Qw2XRMK1N4ZgFsOQudlEexik=
                     </ns4:X509Certificate>
                 </ns4:X509Data>
             </ns4:KeyInfo>
         </ns0:KeyDescriptor>
         <ns0:SingleLogoutService 
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"
Location="http://localhost:8087/slo/redirect"/>
         <ns0:SingleLogoutService 
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
Location="http://localhost:8087/slo/post"/>
         <ns0:AssertionConsumerService 
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
Location="http://localhost:8087/acs/post" index="1"/>
     </ns0:SPSSODescriptor>
</ns0:EntityDescriptor>


-- 
Alessandro Molina
Chief Technical Officer & Director of Operations

Axant s.n.c. - http://www.axant.it
Phone: +39 346 739 9923
Fax: +39 011 412 1756

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20151005/ad0ebebb/attachment-0001.html>