A valid authentication statement was not found in the incoming message

Tue Sep 1 08:51:18 EDT 2015

OK the customer corrected the audience but it still throws the same error and nothing is logged.  Here is the assertion:
<samlp:Response ID="_46adf1e1-0178-423d-b775-48012e997fc4" InResponseTo="_bf9c51b67a1798c5c759acbe1e094ec5" Version="2.0" IssueInstant="2015-09-01T11:17:36Z" Destination="http://shib.release.lynda.com/Shibboleth.sso/SAML2/POST" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"> <saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">urn:componentspace:SkillsServe</saml:Issuer> <Signature xmlns="http://www.w3.org/2000/09/xmldsig#"> <SignedInfo> <CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /> <SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /> <Reference URI="#_46adf1e1-0178-423d-b775-48012e997fc4"> <Transforms> <Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /> <Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"> <InclusiveNamespaces PrefixList="#default code ds kind rw saml samlp typens" xmlns="http://www.w3.org/2001/10/xml-exc-c14n#" /> </Transform> </Transforms> <DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /> <DigestValue>q723YKUNr7G6GVbh3h2d5A1B3G8=</DigestValue> </Reference> </SignedInfo> <SignatureValue>bnR1bC//jdkE2tKxgGBO8QyK02agR7Mi0HsEDOxIieGargbU0miL+UsdUw0FRbSrfpgbIWwgK9l7nO7CFaS16KK39phFNDVmTAdv+8EdXCM7CKpw2yOqxT2j5sxbjsjJ1MnEje25UOpVl+i3mB63wttuComijSUlfMW8nmBPTuxjnwGpiL3fuqHN9V1zwdqQ/Swzih/dYIE6kpIr9WGkE+TSMhZlOa6JSESch328by3PE53Bi4QTPI3rjI5a1bcY9HlD3qZLTWqCJGFj6nVo2LT8sn8Dhnnsk+DBCqmLL9rghS2gi4dsDc5QmBdq4z6vJJFlsFs6MIBmtpqc7Gc/ig==</SignatureValue> <KeyInfo> <X509Data> <X509Certificate>MIIFUzCCBDugAwIBAgISESE9TiJ5p5ZOSEHx5Ccy1P3BMA0GCSqGSIb3DQEBCwUAMGYxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9iYWxTaWduIG52LXNhMTwwOgYDVQQDEzNHbG9iYWxTaWduIE9yZ2FuaXphdGlvbiBWYWxpZGF0aW9uIENBIC0gU0hBMjU2IC0gRzIwHhcNMTQwNDExMTY0MTAyWhcNMTkwNDExMTY0MTAyWjB5MQswCQYDVQQGEwJHQjEPMA0GA1UECBMGRG9yc2V0MRQwEgYDVQQHEwtCb3VybmVtb3V0aDEnMCUGA1UEChMeVW5pY29ybiBUcmFpbmluZyBHcm91cCBMaW1pdGVkMRowGAYDVQQDDBEqLnNraWxsc3NlcnZlLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAJdLkIlLQXjahddXpyo6RVsymVKoNY4yBRepKVfCqtvmDsH78mfWd0cklXMsB5jGOoW6VthjGfbJgaVPG8Vd4/+eIClN5i2ENkOh06DdWmEZ36qicr3IH9g3RGWwGggB8/2Ia784szGwU7mEsaKfDXndAR4UpgidP/Yq2i0kX15gbL/fUqjNbG95YDUNKccgQN8btBQgBGeLrFT5bSjimY0QSU1hovrCs1lbA4RN+I5MtnXaLxpMV6Q5m7jIIP9bOB87gLWeaqnO3QvuuesHneUrpI9iYzw0LTSXQthv7z8DwGBLeJXFqVzxeGl2yrAt6BZTKCjFFa7ApVpRUU5FKq0CAwEAAaOCAeYwggHiMA4GA1UdDwEB/wQEAwIFoDBJBgNVHSAEQjBAMD4GBmeBDAECAjA0MDIGCCsGAQUFBwIBFiZodHRwczovL3d3dy5nbG9iYWxzaWduLmNvbS9yZXBvc2l0b3J5LzAtBgNVHREEJjAkghEqLnNraWxsc3NlcnZlLmNvbYIPc2tpbGxzc2VydmUuY29tMAkGA1UdEwQCMAAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMEkGA1UdHwRCMEAwPqA8oDqGOGh0dHA6Ly9jcmwuZ2xvYmFsc2lnbi5jb20vZ3MvZ3Nvcmdhbml6YXRpb252YWxzaGEyZzIuY3JsMIGgBggrBgEFBQcBAQSBkzCBkDBNBggrBgEFBQcwAoZBaHR0cDovL3NlY3VyZS5nbG9iYWxzaWduLmNvbS9jYWNlcnQvZ3Nvcmdhbml6YXRpb252YWxzaGEyZzJyMS5jcnQwPwYIKwYBBQUHMAGGM2h0dHA6Ly9vY3NwMi5nbG9iYWxzaWduLmNvbS9nc29yZ2FuaXphdGlvbnZhbHNoYTJnMjAdBgNVHQ4EFgQUYBc+CSIL65gkLqYxqXUXYQVYWJcwHwYDVR0jBBgwFoAUlt5h8b0cFilTHMDMfTuDAEDmGnwwDQYJKoZIhvcNAQELBQADggEBAAMfdOkLEG1GvUQYrWWs78FxsnMe98Iu5jNgvQhkGMxsFp4Ed7n29EKbfsZc9Ch/GkiMrjTmmt7PZIKFQpgsm0sat+lZksxd64JjvCLaTn0J9lXEsqyzpgCEBVT9CPemHtHbiCtPlfQ2zvSHzAOzIR7/abtR+l3PnkvUN1ThlkTkJXkOm/t8hOtaF/kHuc7NMZwpm5BoCsH+a/cGqxTTCFRmrQyaMUwOFGF1oHjnTZrDvw7oicbfPmEI0zfV9NfpIm41QBini61GOx190cvuX5griEoTg1w3GMR0J2+MkdigIM7k+pq0JaXK0RUH0jZNJrG45K+6Lj8mNdrg9opG4MU=</X509Certificate> </X509Data> </KeyInfo> </Signature> <samlp:Status> <samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" /> </samlp:Status> <saml:Assertion Version="2.0" ID="_0b9202c7-dcc6-499d-b5b6-321f0a6e980e" IssueInstant="2015-09-01T11:17:36Z" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"> <saml:Issuer>urn:componentspace:SkillsServe</saml:Issuer> <saml:Subject> <saml:NameID>b9154971-fa68-4f2e-b017-a07700d8e62b</saml:NameID> <saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"> <saml:SubjectConfirmationData NotBefore="2015-09-01T11:17:36Z" NotOnOrAfter="2015-09-01T11:22:36Z" Recipient="http://shib.release.lynda.com/Shibboleth.sso/SAML2/POST" InResponseTo="_bf9c51b67a1798c5c759acbe1e094ec5" /> </saml:SubjectConfirmation> </saml:Subject> <saml:Conditions NotBefore="2015-09-01T12:17:36Z" NotOnOrAfter="2015-09-01T12:22:36Z"> <saml:AudienceRestriction> <saml:Audience>https://shib.release.lynda.com/shibboleth-sp</saml:Audience> </saml:AudienceRestriction> </saml:Conditions> <saml:AttributeStatement> <saml:Attribute Name="Email" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"> <saml:AttributeValue>testuser at skillsserve.com</saml:AttributeValue> </saml:Attribute> <saml:Attribute Name="DisplayName" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"> <saml:AttributeValue>Test User</saml:AttributeValue> </saml:Attribute> <saml:Attribute Name="FirstName" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"> <saml:AttributeValue>Test</saml:AttributeValue> </saml:Attribute> <saml:Attribute Name="LastName" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"> <saml:AttributeValue>User</saml:AttributeValue> </saml:Attribute> <saml:Attribute Name="uid" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"> <saml:AttributeValue>test.user</saml:AttributeValue> </saml:Attribute> <saml:Attribute Name="mail" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"> <saml:AttributeValue>testuser at skillsserve.com</saml:AttributeValue> </saml:Attribute> </saml:AttributeStatement> </saml:Assertion></samlp:Response>
Any help greatly appreciated. 

     On Friday, August 28, 2015 8:21 AM, Mike Flynn <shibbolethlynda at yahoo.com> wrote:

 Will do but I am running 2.3.1 on that box so may not be an issue in later version. 

     On Friday, August 28, 2015 7:36 AM, "Cantor, Scott" <cantor.2 at osu.edu> wrote:

 On 8/28/15, 10:29 AM, "users on behalf of Mike Flynn" <users-bounces at shibboleth.net on behalf of shibbolethlynda at yahoo.com> wrote:

>Thanks, Scott.  I think I found the issue.  The saml:AudienceRestriction has
> my production server's value.  Going to have them correct and retest.

Surprised that didn't log, you might want to file a bug on that. It should at least note it on DEBUG if nothing else.

-- Scott

-- 
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20150901/141469ab/attachment-0001.html>