SP cannot decrypt EncryptedAssertion responses

[Matthew X. Economou]

Scott Cantor writes:

> You have the wrong key in your SP's metadata.

The SP certificate in the metadata matches the public key used by both
the Shibboleth SP and the AD FS relying party trust.  I also verified
that the RP trust uses the same certificate for both encryption and
signing.  I double-checked the private key installed on the SP, which is
also correct.  As a precaution I re-deployed the keying material to the
SP.

I couldn't remember if I'd checked the ownership and permissions on the
keying material itself, but after re-deploying the SP's keying material,
I had to fix both (user shibd, group shibd; permissions 644 for the
certificate and 600 for the private key).

After reviewing the SAML protocol captures, I saw that Shibboleth was
not signing the outgoing SAML requests.  I'm sorry but I assumed that
this was the default.  I enabled `signing="true"` and
`encryption="true"` in the SP's ApplicationDefaults, and I set the
signature algorithm to SHA-1 in the RP trust.  With these changes I was
able to authenticate to the SP using an EncryptedAssertion response from
my AD FS IdP.

Thanks for your help!

Best wishes,
Matthew

-- 
"The lyf so short, the craft so longe to learne."