Shib 3.x & alternate credentials

[Dave Bartholomew]

Shibboleth 3.1.2.1 64-bit

Windows Server 2012 R2

java version "1.8.0_65" (Oracle JDK)



Shibboleth installed in C:\Program Files (x86)\Shibboleth via installer
(install Jetty checked).



I'm trying to configure Shib 3.x to emulate what was working in Shib 2.x to
use production credentials on a dev system for InCommon SPs. The
configuration is pretty vanilla with this being the only exception.



While I started with RelyingPartyByTag, I had problems so I backed down to
just trying to get one SP to work for testing purposes. I was able to get
it to work when it was configured as the DefaultRelyingParty, but not as an
override. The following are what I think are the relevant bits for the
failing scenario:



credentials.xml:



<bean id="ProductionSigningCredential"
parent="shibboleth.DefaultSigningCredential"

    p:privateKeyResource="C:\Program Files
(x86)\Shibboleth\IdP\credentials\prod-idp-signing.key"

    p:certificateResource="C:\Program Files
(x86)\Shibboleth\IdP\credentials\prod-idp-signing.crt"

    p:entityId="<production entityID>" />



relying-party.xml:



<bean id="ProductionSecurityConfig"
parent="shibboleth.DefaultSecurityConfiguration">

    <property name="signatureSigningConfiguration">

        <bean parent="shibboleth.SigningConfiguration.SHA256"
p:signingCredentials-ref="ProductionSigningCredential" />

    </property>

</bean>



<util:list id="shibboleth.RelyingPartyOverrides">

      <bean parent="RelyingPartyByName" c:relyingPartyIds="<SP entityID>"
p:responderId="<production entityID>" >

          <property name="profileConfigurations">

              <list>

                  <bean parent="SAML2.SSO"
p:securityConfiguration-ref="ProductionSecurityConfig"
p:encryptAssertions="false" />

              </list>

          </property>

      </bean>

</util:list>



I get an "Unable to establish security of incoming assertion" error which
is not surprising given that the issuer in the response is the installation
default not the responderId.



However, if I take basically the same configuration and make it the
DefaultRelyingParty as below, it works:



<bean id="shibboleth.DefaultRelyingParty" parent="RelyingParty"
p:responderId="<production entityID>" >

    <property name="profileConfigurations">

        <list>

            <bean parent="SAML2.SSO"
p:securityConfiguration-ref="ProductionSecurityConfig"
p:encryptAssertions="false" />

        </list>

    </property>

</bean>



This behavior would lead me to believe that I'm not understanding override
fundamentals (which wouldn't surprise me since I've never written a "hello
world" Java program). Any enlightenment would be appreciated.

Thanks.



--Dave
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20151027/47f1b833/attachment-0001.html>