Could not resolve key encryption credential

[Brent Putman]

On 10/7/15 6:10 PM, Willem D'Haeseleer wrote:
>
>
> When I try to login I get redirected back to my SP but the the IDP
> fails to encrypt the assertion. 
> It gives the following error:
> 17:55:15.117 - ERROR [edu.internet2.middleware.shibboleth.idp.profile.saml2.AbstractSAML2ProfileHandler:927] - Could not resolve a key encryption credential for peer entity: http://local.origami42.com:8000/metadata/
> 17:55:15.117 - ERROR [edu.internet2.middleware.shibboleth.idp.profile.saml2.AbstractSAML2ProfileHandler:289] - Unable to construct encrypter
> org.opensaml.xml.security.SecurityException: Could not resolve key encryption credential
> Why can't the IDP encrypt the assertion ?

Well, it really does mean that the metadata that the IdP has for your
SP doesn't have an encryption key in it.  Since the metadata file you
attached does seem to have a key descriptor with use="encryption", and
the entityIDs seem to match up, the logical conclusion is that the IdP
isn't actually using that metadata.

> Am I using an incorrect certificate / public key, should I update the
> medata somehow ?

I would double-check what metadata testshib actually has for your SP
and/or upload it again.

Could also potentially be something on the testshib end, like not
having reloaded new metadata or something.  Occasionally it has hiccups.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20151007/b5bf66c1/attachment.html>