Could not resolve key encryption credential

[Willem D'Haeseleer]

How can I verify what metadata the IDP has for me ? I have tried uploading
my metadata file again several times using the same file name. I am not
aware of another method to update the metadata.




On Wed, Oct 7, 2015 at 3:44 PM, Brent Putman <putmanb at georgetown.edu> wrote:

>
>
> On 10/7/15 6:10 PM, Willem D'Haeseleer wrote:
>
>
>
> When I try to login I get redirected back to my SP but the the IDP fails
> to encrypt the assertion.
> It gives the following error:
>
> 17:55:15.117 - ERROR [edu.internet2.middleware.shibboleth.idp.profile.saml2.AbstractSAML2ProfileHandler:927] - Could not resolve a key encryption credential for peer entity: http://local.origami42.com:8000/metadata/
> 17:55:15.117 - ERROR [edu.internet2.middleware.shibboleth.idp.profile.saml2.AbstractSAML2ProfileHandler:289] - Unable to construct encrypter
> org.opensaml.xml.security.SecurityException: Could not resolve key encryption credential
>
>  Why can't the IDP encrypt the assertion ?
>
>
> Well, it really does mean that the metadata that the IdP has for your SP
> doesn't have an encryption key in it.  Since the metadata file you attached
> does seem to have a key descriptor with use="encryption", and the entityIDs
> seem to match up, the logical conclusion is that the IdP isn't actually
> using that metadata.
>
> Am I using an incorrect certificate / public key, should I update the medata somehow ?
>
>
> I would double-check what metadata testshib actually has for your SP
> and/or upload it again.
>
> Could also potentially be something on the testshib end, like not having
> reloaded new metadata or something.  Occasionally it has hiccups.
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20151007/a8985582/attachment.html>