SP is not accepting the certificate of the IDP

[Yasser Afifi]

>
> Message: 4
> Date: Fri, 29 Jan 2016 12:35:52 +0100
> From: Peter Schober <peter.schober at univie.ac.at>
> To: users at shibboleth.net
> Subject: Re: SP is not accepting the certificate of the IDP
> Message-ID: <20160129113552.GI9732 at aco.net>
> Content-Type: text/plain; charset=us-ascii
>
> * Yasser Afifi <yasser at 3dissue.com> [2016-01-29 11:09]:
> > My SP was working fine with my IDP, then i deployed them on an Ubuntu
> test
> > server. IDP created a certificate while being installed that had the
> > hostname in it. I then changed my DNS name but the certificate is still
> > issued to old hostname. But this makes the SP not accepting the assertion
> > from the IDP.
>
> If the SP is Shibboleth then that's not what happens.
> The only place the hostname inside the IDP's cert comes into play is
> during backchannel/SOAP requests (such as attribtue queries) and you
> shouldn't need those.
>
> > How can I solve this? How can i make the IDP create a new certificate for
> > the new hostname?
>
> Try the documentation.
>
> > I tried using the keygen tool and supplied --hostname myHostName but it
> > doesn't create new certificates!
> >
> > the error i get is Unable to establish security of incoming assertion
>
> That's not the error during certificate creation, though.
> If you change the keys on the IDP (which you shouldn't have done in
> the first place) you'll also have to supply them to everyone your IDP
> fderates with. I.e., you'll need to supply updated SAML Metadata to
> the SAML SP.
>
> > I got this same problem before on windows and i changed the hostname and
> > reinstalled shibboleth idp and it generated certificates for the new name
> > and the problem was solved. But i can't really do that on Ubuntu server!
>
> The software doesn't know or care whether it runs on MS-Windows or on
> Unix, it's a Java servlet. So that wouldn't account for any of the
> differences you observe.
> -peter
>
>

Hello Peter,
Thanks a lot for your reply, Why am I getting this error then?  " Unable to
establish security of incoming assertion". I matched the certificates (in
both idp metadata and the actual certificates in /credentials). I also made
sure that the SP has the correct metadata with all this info. Why would I
still get this error?
My Second question is if we are not using the SOAP attribute query, should
i comment it out in the metadata? I mean this one:
        <AttributeService
Binding="urn:oasis:names:tc:SAML:1.0:bindings:SOAP-binding" Location="
https://3dissueyasser.com:8443/idp/profile/SAML1/SOAP/AttributeQuery"/>

do you think this might make problems if i leave it?

My third question is, at production deployment, if i want to use my
company's certificate inside the IDP, how can I do that? or should i keep
the IDP-generated certificates?

Thanks again,
Kind Regards,
Yasser
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160129/48b02a2f/attachment.html>